Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

ash_admin

7 known vulnerabilities (4 high, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 4 high, 3 low
Registry
Hex

Advisories 7

  • Path traversal in AshAdmin file uploads via unsanitized client filename

    Affected: from 0.13.7, fixed in 1.3.1; from 0.13.7, fixed in 1.3.1.

  • AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

    Affected: from 0.1.0, fixed in 1.3.1; from 0.1.0, fixed in 1.3.1.

  • AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass

    Affected: from 0.10.8, fixed in 1.3.1; from 0.10.8, fixed in 1.3.1.

  • Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

    Affected: from 0.3.0-rc.0, fixed in 1.3.1; from 0.3.0-rc.0, fixed in 1.3.1.

  • Stored XSS in AshAdmin relationship typeahead via unescaped label_field content

    Affected: from 0.13.0, fixed in 1.3.1; from 0.13.0, fixed in 1.3.1.

  • AshAdmin LiveView events intern atoms from client input, exhausting the atom table (node DoS)

    Affected: from 0.1.0, fixed in 1.3.1; from 0.1.0, fixed in 1.3.1.

  • AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomain

    Affected: from 0.9.1, fixed in 1.3.1; from 0.9.1, fixed in 1.3.1.