Common
Monthly
Server-side request forgery in @pdfme/common before 5.5.10 allows attackers who control the basePdf template field to force SSR-context servers to issue arbitrary HTTP requests to internal endpoints without any URL validation. The unvalidated fetch() call in getB64BasePdf - reachable from the generator, UI hooks, and UI helper entry points - enables exfiltration from cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), blind network reconnaissance, and lateral pivot to internal APIs. A detailed proof-of-concept is embedded in GHSA-pgx6-7jcq-2qff; no CISA KEV listing is present at time of analysis.
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Common is a package of common modules that can be accessed by NIMBLE services. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
XMLReader.php in PHPOffice Common before 0.2.9 allows XXE. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Alpine Linux: buildah fixed in 1.37.4-r0
Server-side request forgery in @pdfme/common before 5.5.10 allows attackers who control the basePdf template field to force SSR-context servers to issue arbitrary HTTP requests to internal endpoints without any URL validation. The unvalidated fetch() call in getB64BasePdf - reachable from the generator, UI hooks, and UI helper entry points - enables exfiltration from cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), blind network reconnaissance, and lateral pivot to internal APIs. A detailed proof-of-concept is embedded in GHSA-pgx6-7jcq-2qff; no CISA KEV listing is present at time of analysis.
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function setValue. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Common is a package of common modules that can be accessed by NIMBLE services. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
XMLReader.php in PHPOffice Common before 0.2.9 allows XXE. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Alpine Linux: buildah fixed in 1.37.4-r0