Vendor
hexpm
19 known vulnerabilities.
Products
6 results · Clear filters · Feed
-
Low 2.1
hex_core decompresses registry and Erlang term API responses without size limits
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a server answering hex_core's API requests, to exhaust the memory of the Erlang VM running hex_core. The same code is ve…
-
Low 2.3
Terminal escape sequence injection in Hex via unneutralized server-supplied output
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile repository server to inject terminal control sequences into the output of Mix tasks. Hex prints strings supplied by the …
-
Low 2.1
Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetc…
-
Low 2.3
Refresh tokens accepted as private repository credentials at the CDN
Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh t…
-
Low 2.3
Explicit organization scopes survive token refresh after membership ends
Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expand_repositories_scope/3 in lib/hexpm/permissions.ex only rewrites the literal re…
-
Low 2.0
Unsafe Deserialization of Erlang Terms in hex_core
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is as…