Approved changes feed: RSS · Atom
cpe:2.3:a:cuyz:valinor:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cuyz (af6f8fd1-e9ec-50af-8ba8-229247d1c7db) |
|---|---|
| Product | Valinor (ba203128-4fc6-5cb8-af54-29a2b1fc4462) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cuyz/valinor |
purl2cpe | 2026-06-01 10:14:06.679966 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2022-31140 |
vulnerable | 2026-06-08 05:43:40.274743 |
Valinor error messages leading to potential data exfiltration
HIGH (7.5)
Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessage()` when it should not have permission to do so. This is a problem with cases such as an SQL exception showing an SQL snippet, a database connection exception showing database IP address/username/password, or a timeout detail / out of memory detail. Attackers could use this information for potential data exfiltration, denial of service attacks, enumeration attacks, etc. Version 0.12.0 contains a patch for this vulnerability.
Published: 2022-07-11T19:55:09.000Z
Updated: 2025-04-22T17:49:30.998Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.