Threat Intelligence Database

Webpack versions from 5.49.0 up to but not including 5.104.0 have a vulnerability in the HttpUriPlugin when experiments.buildHttp is enabled. The plugin enforces allowedUris only on the initial URL but fails to re-validate after HTTP redirects, allowing bypass of the allow-list. This can lead to build-time SSRF and inclusion of untrusted content in build outputs. The issue is fixed in version 5.104.0.

Webpack versions from 5.49.0 up to but not including 5.104.1 have a vulnerability in the HTTP(S) resolver when experiments.buildHttp is enabled. This flaw allows bypassing the allowedUris allow-list by using URLs with userinfo (username:password@host), leading to build-time SSRF and untrusted content inclusion. The issue is patched in version 5.104.1.

Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale. Data Grid 8.5.2 replaces Data Grid 8.5.1 and includes bug fixes and enhancements. Find out more about Data Grid 8.5.2 in the Release Notes[3]. Security Fix(es): * CVE-2024-47072 com.thoughtworks.xstream/xstream: XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream [jdg-8] (CVE-2024-47072) * CVE-2024-43788 webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule [jdg-8] (CVE-2024-43788) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.