7367 matches found
WS-2019-0386
@fangrong/xoc version 1.0.6 contains malicious code which steals sensitive information such as cardnumbers and passwords from forms in the browser and send them to "hps://js-metrics.com/minjs.php?pl="...
WS-2018-0625
The package xmlbuilder-js before 9.0.5 is vulnerable to denial of service due to a regular expression issue...
WS-2020-0050
1337qq-js is a malicious package, on Unix systems the package allows remote attackers to disclose sensitive information...
@mongodb-js/compass-aggregations (>=0.0.20, <=4.1.0), @mongodb-js/compass-export-to-language (>=2.2.22, <=2.2.24) +4 more potentially affected by unknown CVE via mongodb-query-parser (>=0.0.1, <=1.5.0)
mongodb-query-parser NPM version =0.0.1, =0.0.20, =2.2.22, =0.0.3, =3.0.0, =1.0.3, =0.0.1, =0.4.2 Source cves: unknown CVE Source advisory: MEND:WS-2020-0025...
detherjs (>=4.2.3, <=4.2.15), secure-cookies-js (>=1.0.0, <=1.1.1) +1 more potentially affected by unknown CVE via simple-crypto-js (>=1.1.0, <=1.1.1)
simple-crypto-js NPM version =1.1.0, =4.2.3, =1.0.0, =0.1.1, =0.1.2 Source cves: unknown CVE Source advisory: MEND:WS-2020-0010...
WS-2020-0010
All versions of simple-crypto-js use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data...
WS-2019-0341
Cross-Site Scripting vulnerability found in nextcloud-vue-collections before 0.4.2. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's...
WS-2019-0316
In saml2-js, versions prior to v2.0.5 are vulnerable to authentication bypass due the failure of enforcement of assertion conditions...
auth-saml (0.0.1), authx (>=1.2.0, <=1.2.4) +2 more potentially affected by unknown CVE via saml2-js (>=1.10.0, <=1.12.4)
saml2-js NPM version =1.10.0, =1.2.0, =0.0.1, =0.10.0, =0.11.3 Source cves: unknown CVE Source advisory: MEND:WS-2019-0316...
untitled-js (>=1.0.0, <=1.0.9) potentially affected by unknown CVE via untitled-model (1.0.5)
untitled-model NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on untitled-model and may be impacted: - untitled-js =1.0.0, =1.0.9 Source cves: unknown CVE Source advisory: MEND:WS-2019-0233...
WS-2019-0208
bpmn-js-properties-panel before 0.31.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...
@dotgov/bpmn (>=0.0.1, <=0.0.29), @dotgov/z_bpmn (>=0.0.1, <=2.0.0) +19 more potentially affected by unknown CVE via bpmn-js-properties-panel (>=0.11.2, <=0.30.0)
bpmn-js-properties-panel NPM version =0.11.2, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.1, =1.1.22, =1.0.97, =2.0.0, =1.0.14, =0.0.1, =0.0.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0208...
@quarks/bpmn-extension (>=1.0.0, <=1.0.142) potentially affected by unknown CVE via cmmn-js-properties-panel (0.4.0)
cmmn-js-properties-panel NPM version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cmmn-js-properties-panel and may be impacted: - @quarks/bpmn-extension =1.0.0, =1.0.142 Source cves: unknown CVE Source advisory: MEND:WS-2019-0207...
WS-2019-0207
cmmn-js-properties-panel before 0.8.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...
WS-2019-0206
dmn-js-properties-panel before 0.3.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...
WS-2019-0175
diagram-js versions 2.x before 2.6.2 and 3.x before 3.3.1 fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript...
WS-2019-0148
diagram-js-direct-editing versions before 1.4.3 fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser...
@dotgov/bpmn (>=0.0.1, <=0.0.29), @dotgov/z_bpmn (>=0.0.1, <=2.0.0) +14 more potentially affected by unknown CVE via diagram-js-direct-editing (>=0.4.0, <=0.23.0)
diagram-js-direct-editing NPM version =0.4.0, =0.0.1, =0.0.1, =1.0.0, =0.5.0, =1.20.7, =0.7.2, =1.0.0, =1.0.0, =0.2.2, =0.0.7, =2.0.0, =2.2.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0148...
i18n-it-all (0.4.0) potentially affected by unknown CVE via js-quantities (1.6.3)
js-quantities NPM version 1.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on js-quantities and may be impacted: - i18n-it-all 0.4.0 Source cves: unknown CVE Source advisory: MEND:WS-2017-0278...