admin/felhom.eu
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security-watch: memory of 2026-11-07 (R-1303). Docs only.

Browse Source
This commit is contained in:
felhom security watch committed 2026-11-07 03:44:20 +00:00
1 parent 599ea69551
commit 6d52329e3f
1 file changed
+80 -56
Download Patch File Download Diff File Expand all files Collapse all files
documentation/security-watch/state.json
+80 -56
View File
@@ -56,6 +56,12 @@
"program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
"summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
},
"codewithcj/sparkyfitness_server|GHSA-q26v-g5pj-r882": {
"first": "2026-11-07",
"last_mailed": "2026-11-07",
"program": "codewithcj/sparkyfitness_server v0.17.3 (sparkyfitness)",
"summary": "IDOR/BOLA: any authenticated user can list another user's external data-provider connections via an RLS owner-branch that trusts the data-owner context instead "
},
"codewithcj/sparkyfitness_server|GHSA-v883-jx9h-qf29": {
"first": "2026-10-28",
"last_mailed": "2026-11-04",
@@ -74,6 +80,12 @@
"program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
"summary": "Authenticated user can overwrite another user's Withings connection through unvalidated OAuth state"
},
"codewithcj/sparkyfitness|GHSA-q26v-g5pj-r882": {
"first": "2026-11-07",
"last_mailed": "2026-11-07",
"program": "codewithcj/sparkyfitness v0.17.3 (sparkyfitness)",
"summary": "IDOR/BOLA: any authenticated user can list another user's external data-provider connections via an RLS owner-branch that trusts the data-owner context instead "
},
"codewithcj/sparkyfitness|GHSA-v883-jx9h-qf29": {
"first": "2026-10-28",
"last_mailed": "2026-11-04",
@@ -110,12 +122,24 @@
"program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)",
"summary": "Node.js 24.22.0 inside the image: Brotli decoder out-of-bounds write (HTTP2Shell): a crafted compressed body can run code in the process"
},
"dooplex:codewithcj/sparkyfitness_server|GHSA-q26v-g5pj-r882": {
"first": "2026-11-07",
"last_mailed": "2026-11-07",
"program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)",
"summary": "IDOR/BOLA: any authenticated user can list another user's external data-provider connections via an RLS owner-branch that trusts the data-owner context instead "
},
"dooplex:codewithcj/sparkyfitness_server|release:CodeWithCJ/SparkyFitness@v1.10.0": {
"first": "2026-10-29",
"last_mailed": "2026-11-05",
"program": "codewithcj/sparkyfitness_server v1.9.0 (workout-system/sparkyfitness.yaml)",
"summary": "1 for CVE-2026-111497 by @nalvazhvu in #3111"
},
"dooplex:codewithcj/sparkyfitness|GHSA-q26v-g5pj-r882": {
"first": "2026-11-07",
"last_mailed": "2026-11-07",
"program": "codewithcj/sparkyfitness v1.9.0 (workout-system/sparkyfitness.yaml)",
"summary": "IDOR/BOLA: any authenticated user can list another user's external data-provider connections via an RLS owner-branch that trusts the data-owner context instead "
},
"dooplex:codewithcj/sparkyfitness|release:CodeWithCJ/SparkyFitness@v1.10.0": {
"first": "2026-10-29",
"last_mailed": "2026-11-05",
@@ -2352,19 +2376,6 @@
"python": null,
"unchecked": []
},
"sha256:1e7c2345c493f9228a5dc2102be06b5a33331100f303fe0078502f4ef1068724": {
"apk": {
"brotli-libs": "1.2.0-r1"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:20a187e25a0872c2b7147c729e949c1611bdd32273109e92bb14ad08211d1b36",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:1feaaf724694d08a1fb19370b6ff37e6669edb16cae69e02660177253f903dc1": {
"apk": {},
"brotli": null,
@@ -2590,19 +2601,6 @@
"python": null,
"unchecked": []
},
"sha256:386c962ee6e260e3a5656b25df2ed056bcc9b6410e197d075f9547fd14c23bca": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:ee40ad01f650ef45d07b07eb149258104fbd07c23f6300eb9ab07227e536704f",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:38dc2727bfcfd5ede290f8ada114fc90368146f265ae4701ddddbcbe2a44ee52": {
"apk": {
"brotli-libs": "1.1.0-r2"
@@ -2616,6 +2614,19 @@
"python": null,
"unchecked": []
},
"sha256:3b8c947d7fa173f70e40047d2c8d02835fb8416aeb5ae36def57d9ad15e2f906": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:7c88dcb802a230f6f1f94dbb6a10a04d39a2db3971c798e1c5d165913374840b",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:40c454d74ffdd9ecb15833e4d96f3a630d59aad862a1869381ae6ee086454419": {
"apk": {},
"brotli": null,
@@ -2935,6 +2946,23 @@
"python": null,
"unchecked": []
},
"sha256:6f060cab421d9509c6c6a6a7762c651baf03c3f1d0145befe16b688762b7fe81": {
"apk": {},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:1c4b59c1b05a318de5b55c0f82a0fd346eae9363bc959c49ebb476b06b02f20e",
"dpkg": {
"libbrotli1": "1.0.9-2+deb12u1",
"python3": "3.11.2-1+b1",
"python3.11": "3.11.2-6+deb12u9"
},
"env": {
"PYTHON_VERSION": "3.15.2"
},
"node": null,
"python": "3.15.2",
"unchecked": []
},
"sha256:6f8f1fc29d1ff67b4d8d503bb4e0a69b55c8d42600decafde951344218193a27": {
"apk": {
"brotli-libs": "1.1.0-r2"
@@ -2962,6 +2990,19 @@
"python": null,
"unchecked": []
},
"sha256:713fc2ebfd92e8217db451477182ee91944b123d2b1ee9fd5a8c6e91ca6c3a11": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:697b0b156c70b91130853fd0675c6be36665939d5f93dce2686be04b4c3f98a8",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:71885d8cc6e42f2bc0aa2eb853bfc4be200b5108a46ac50e117ae1df0531fb80": {
"apk": {},
"brotli": null,
@@ -3407,23 +3448,6 @@
"python": null,
"unchecked": []
},
"sha256:a4f372966d9f3f0935c724d1353172d6cc51683f50aee5395675857326bd6a6b": {
"apk": {},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:1c4b59c1b05a318de5b55c0f82a0fd346eae9363bc959c49ebb476b06b02f20e",
"dpkg": {
"libbrotli1": "1.0.9-2+deb12u1",
"python3": "3.11.2-1+b1",
"python3.11": "3.11.2-6+deb12u9"
},
"env": {
"PYTHON_VERSION": "3.15.2"
},
"node": null,
"python": "3.15.2",
"unchecked": []
},
"sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2": {
"apk": {},
"brotli": null,
@@ -3588,19 +3612,6 @@
"python": null,
"unchecked": []
},
"sha256:b2f80f8f88146b0772fdcc7d92cea621aa8c2889fa8d07ed61d4884fcea53e09": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:697b0b156c70b91130853fd0675c6be36665939d5f93dce2686be04b4c3f98a8",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:b3b00047ed20f6ce2b16780145cb6a0acb51c9e28ea6aa6f5dcd33c7034f1797": {
"apk": {
"brotli-libs": "1.2.0-r1"
@@ -3929,6 +3940,19 @@
"python": null,
"unchecked": []
},
"sha256:e01e61ac6bfbf34a2003364e1499faf2da0fba0a485e0f4b31c49b6576b95e9d": {
"apk": {
"brotli-libs": "1.2.1-r0"
},
"brotli": null,
"brotlicffi": null,
"digest": "sha256:1471c7d8d54828af6ad2a5d1067527cd87a9cae48f3905751c57b2ebda627f21",
"dpkg": {},
"env": {},
"node": null,
"python": null,
"unchecked": []
},
"sha256:e3da62a847b9a5d51a11f73cfea1d9c13c3be3809614490d4edddcf01dcf919b": {
"apk": {},
"brotli": null,