Nixpkgs security tracker
3.5 LOW
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): None (N)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Exploit Code Maturity (E): Proof-of-Concept (P)
- Remediation Level (RL): Not Defined (X)
- Report Confidence (RC): Reasonable (R)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): None (N)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @mweinelt Activity log
- Created suggestion
- @LeSuisse ignored package tests.home-assistant-component-tests.ecoforest
-
@mweinelt
ignored
17 packages
- everforest-cursors
- everforest-gtk-theme
- haskellPackages.dirforest
- haskellPackages.data-forest
- python312Packages.pyecoforest
- python313Packages.pyecoforest
- python314Packages.pyecoforest
- haskellPackages.ForestStructures
- python312Packages.quantile-forest
- python313Packages.quantile-forest
- python314Packages.quantile-forest
- haskellPackages.genvalidity-dirforest
- home-assistant-component-tests.ecoforest
- home-assistant-component-tests.rainforest_eagle
- home-assistant-component-tests.rainforest_raven
- tests.home-assistant-component-tests.rainforest_eagle
- tests.home-assistant-component-tests.rainforest_raven
- @mweinelt dismissed
rymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting
A vulnerability was detected in rymcu forest up to 0.0.5. This affects the function updateUserInfo of the file - src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java of the component User Profile Handler. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
-
VDB-347317 | rymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting technical-descriptionvdb-entry
-
Affected products
- ==0.0.3
- ==0.0.4
- ==0.0.5
- ==0.0.1
- ==0.0.2
Ignored packages (18)
pkgs.everforest-cursors
Everforest cursor theme, based on phinger-cursors
-
nixos-unstable 3212590527
- nixpkgs-unstable 3212590527
- nixos-unstable-small 3212590527
pkgs.everforest-gtk-theme
Everforest colour palette for GTK
-
nixos-unstable 0-unstable-2025-10-15
- nixpkgs-unstable 0-unstable-2025-10-15
- nixos-unstable-small 0-unstable-2025-10-15
pkgs.haskellPackages.dirforest
Typed directory forest
pkgs.haskellPackages.data-forest
None
pkgs.python312Packages.pyecoforest
None
pkgs.python313Packages.pyecoforest
Module for interacting with Ecoforest devices
pkgs.python314Packages.pyecoforest
Module for interacting with Ecoforest devices
pkgs.haskellPackages.ForestStructures
Tree- and forest structures
pkgs.python312Packages.quantile-forest
None
pkgs.python313Packages.quantile-forest
Quantile Regression Forests compatible with scikit-learn
pkgs.python314Packages.quantile-forest
Quantile Regression Forests compatible with scikit-learn
pkgs.haskellPackages.genvalidity-dirforest
Generators for typed directory forests
pkgs.home-assistant-component-tests.ecoforest
None
pkgs.tests.home-assistant-component-tests.ecoforest
Open source home automation that puts local control and privacy first
pkgs.tests.home-assistant-component-tests.rainforest_eagle
Open source home automation that puts local control and privacy first
pkgs.tests.home-assistant-component-tests.rainforest_raven
Open source home automation that puts local control and privacy first