cve-services vulnerabilities

2 known vulnerabilities in cve-services from CVEProject. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  cve-services: Cleartext Storage of Sensitive Information

  CVE-2022-31004Jun 2, 2022CVEProject

  CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be written to disk. The affected method writes the generated randomKey to disk if the environment is not

• 7.5 High severity

  cve-services: Insertion of Sensitive Information into Log File

  CVE-2022-24875Apr 21, 2022CVEProject

  The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be availabl