Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/endroid/qr-code-bundle@3.0.1
Typecomposer
Namespaceendroid
Nameqr-code-bundle
Version3.0.1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.4.2
Latest_non_vulnerable_version3.4.2
Affected_by_vulnerabilities
0
url VCID-87aw-n6zu-abar
vulnerability_id VCID-87aw-n6zu-abar
summary 
endroid/qr-code-bundle File Disclosure via logo_path query parameter
Versions of endroid/qr-code-bundle prior to 3.4.2 are affected by a security vulnerability that allows disclosure of files through the logo_path query parameter. The vulnerability arises from the improper handling of non-image data as the logo, which could lead to unintended file disclosure.
references
0
reference_url https://github.com/endroid/qr-code-bundle
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/endroid/qr-code-bundle
1
reference_url https://github.com/endroid/qr-code-bundle/commit/51928eaaa30e7db1fd3f1076744dcbc8f8cec8c8
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/endroid/qr-code-bundle/commit/51928eaaa30e7db1fd3f1076744dcbc8f8cec8c8
2
reference_url https://github.com/endroid/qr-code-bundle/releases/tag/3.4.2
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/endroid/qr-code-bundle/releases/tag/3.4.2
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/endroid/qr-code-bundle/2019-12-22.yaml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/endroid/qr-code-bundle/2019-12-22.yaml
4
reference_url https://github.com/advisories/GHSA-mvf6-3f2g-xfxf
reference_id GHSA-mvf6-3f2g-xfxf
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-mvf6-3f2g-xfxf
fixed_packages
0
url pkg:composer/endroid/qr-code-bundle@3.4.2
purl pkg:composer/endroid/qr-code-bundle@3.4.2
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/endroid/qr-code-bundle@3.4.2
aliases GHSA-mvf6-3f2g-xfxf
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-87aw-n6zu-abar
Fixing_vulnerabilities
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/endroid/qr-code-bundle@3.0.1