Skip to content
OpenAdvisories

Ecosystem

Hex

356 known vulnerabilities.

Most affected packages

ash 31 bandit 24 ash_authentication 24 hackney 17 mint 14 mpp 13 jose 9 ash_typescript 8 plug 8 cowlib 8 ash_ai 8 ash_admin 7 mdex 6 livebook 6 html_sanitize_ex 6 ash_graphql 6 ash_authentication_oauth2_server 6 hex_core 5 phoenix 5 tesla 5 ash_sql 5 esaml 4 ash_postgres 4 gun 4 grpc 4 mdex_native 4 guardian 4 cowboy 4 ash_phoenix 4 rabbit_common 4 ash_authentication_phoenix 3 postgrex 3 phoenix_storybook 3 xml_builder 3 saxy 3 samly 3 boruta 3 ash_paper_trail 3 ewe 3 beam_mcp 2
All Critical High Medium Low Exploited only Public exploit

133 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-50966

    erlang-jose vulnerable to denial of service via large p2c value

    erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value in a JOSE header.

    jose erlang-jose erlang-jose Debian Ubuntu Hex
  • Medium 4.9
    CVE-2023-46118

    Denial of Service by publishing large messages over the HTTP API

    RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish …

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Hex
  • Medium 6.5
    CVE-2023-42446

    Pow Mnesia cache doesn't invalidate all expired keys on startup

    Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated …

    pow-auth pow pow Hex
  • Medium 6.1
    CVE-2021-46871

    phoenix_html allows Cross-site Scripting in HEEx class attributes

    tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.

    phoenix_html phoenix_html npm Hex
  • Medium 5.5
    CVE-2022-31008

    Predictable credential obfuscation seed value used in rabbitmq-server

    RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This mea…

    rabbitmq rabbitmq-server rabbitmq-server rabbit_common Debian Ubuntu Hex
  • Medium 6.5
    CVE-2020-5205

    Session fixation attack in Pow (Hex package)

    In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, d…

    danschultzer Pow pow Hex
  • Medium 6.5
    CVE-2019-16764

    PowAssent is susceptible to denial of service attacks

    The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so i…

    pow-auth pow_assent pow_assent Hex
  • Medium 4.5
    CVE-2019-11287 Public exploit

    RabbitMQ Web Management Plugin DoS via heap overflow

    Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack…

    Pivotal RabbitMQ RabbitMQ for Pivotal Platform rabbitmq-server Debian Ubuntu Hex
  • Medium 6.5
    CVE-2018-1000883

    Header Injection

    Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to…

    plug Hex
  • Medium 6.5
    CVE-2018-20301

    Permissive parameters and privilege escalation

    An issue was discovered in Steve Pallen Coherence before 0.5.2 that is similar to a Mass Assignment vulnerability. In particular, "registration" endpoints (e.g., creating, editing, updating) allow users to update any coherence_fields data. For example, users …

    coherence Hex
  • Medium 6.1
    CVE-2018-20302

    Cross-site Scripting in xain

    An XSS issue was discovered in Steve Pallen Xain before 0.6.2 via the order parameter.

    xain Hex
  • Medium 6.1
    CVE-2017-1000163

    Phoenix Arbitrary URL Redirect

    The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirection, which may result in phishing or social engineering attacks.

    phoenix Hex
  • Medium —
    CVE-2011-4320

    Ejabberd DoS via malformed stanza

    The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.

    ejabberd ejabberd Debian Hex