Red Hat Red Hat 3scale API Management Platform 2 vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Red Hat Red Hat 3scale API Management Platform 2: 3 record(s), with affected versions and fixes.
CVE-2024-12125
High · 7.5
CWE-281 Nov 6, 2025
3scale-porta: readonly fields not validated server-side
A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.
CVE-2025-49794
Critical · 9.1
CWE-825 Jun 16, 2025
Libxml: heap use after free (uaf) leads to denial of service (dos)
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.
CVE-2024-11831
Medium · 5.4
CWE-79 Feb 10, 2025
Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.