CVE-2021-4329 json-logic-js logic.js command injection

A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as...

CVE-2021-4329

CVE-2021-4329 (json-logic-js 2.0.0) has a command-injection vulnerability in the logic.js component, enabling arbitrary code execution as described across multiple sources. The issue affects json-logic-js 2.0.0 and is fixed by upgrading to 2.0.1, with the patch identified as c1dd82f5b15d8a553bb7a...

CVE-2021-4329 json-logic-js logic.js command injection

A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as...

CVE-2021-4329

A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as...

CVE-2021-4329: Improper Neutralization of Special Elements used in a Command

A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The patch is identified as...

PT-2023-36074 · Unknown · Json-Logic-Js

Name of the Vulnerable Software and Affected Versions: json-logic-js version 2.0.0 Description: A critical issue has been found in json-logic-js, affecting some unknown functionality of the file logic.js. The manipulation leads to command injection. Recommendations: For json-logic-js version 2.0....

json-logic-js command injection vulnerability

json-logic-js is an application by Jeremy Wadhams personal developer. It is used to build complex rules, serialize them to JSON, and execute them in JavaScript. A command injection vulnerability exists in versions of json-logic-js prior to 2.0.1, which stems from the presence of a command injecti...

PT-2023-12425 · Unknown · Json-Logic-Js

Name of the Vulnerable Software and Affected Versions: json-logic-js version 2.0.0 Description: A critical issue has been found in the json-logic-js software, affecting some unknown functionality of the file logic.js. The manipulation of this issue leads to command injection. Recommendations: For...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to denial of service due to [CVE-2022-25927]

Summary Node.js module ua-parser-js is used by IBM App Connect Enterprise Certified Container DesignerAuthoring instances. IBM App Connect Enterprise Certified Container DesignerAuthoring operands may be vulnerable to denial of service. This bulletin provides patch information to address the...

Malicious Package

Overview gateleen-hook-js is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

@galenjs/framework-next (>=1.0.0, <=1.7.0), @galenjs/models (>=1.1.11-alpha.0, <=1.7.0) +4 more potentially affected by CVE-2023-22578 via @sequelize/core (7.0.0-alpha.10)

@sequelize/core NPM version 7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11-alpha.0, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22578 Sourc...

io.undertow.js:undertow-js (>=1.0.0.alpha3, <=1.1.0.beta1), io.undertow.js:undertow-js-freemarker (1.1.0.beta1) +69 more potentially affected by CVE-2022-4492 via io.undertow:undertow-core (1.3.0.beta6)

io.undertow:undertow-core MAVEN version 1.3.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow.js:undertow-js =1.0.0.alpha3, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.beta1 ...

@galenjs/framework-next (>=1.0.0, <=1.7.0), @galenjs/models (>=1.1.11-alpha.0, <=1.7.0) +4 more potentially affected by CVE-2023-22579 via @sequelize/core (7.0.0-alpha.10)

@sequelize/core NPM version 7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11-alpha.0, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22579 Sourc...

@galenjs/framework-next (>=1.0.0, <=1.7.0), @galenjs/models (>=1.1.11-alpha.0, <=1.7.0) +4 more potentially affected by CVE-2023-22579 via @sequelize/core (7.0.0-alpha.10)

@sequelize/core NPM version 7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11-alpha.0, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22579 Sourc...

SUSE CVE-2023-23918

A privilege escalation vulnerability exists in Node.js 19.6.1, 18.14.1, 16.19.1 and 14.21.3 that made it possible to bypass the experimental Permissions https://nodejs.org/api/permissions.html feature in Node.js and access non authorized modules by using process.mainModule.require. This only...

SUSE CVE-2023-23920

An untrusted search path vulnerability exists in Node.js. 19.6.1, 18.14.1, 16.19.1, and 14.21.3 that could allow an attacker to search and potentially load ICU data when running with elevated privileges...

WordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Software JS Job Manager Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.0.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25963 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b81c2469b6ab Credits Fariq Fadillah Gusti...

WordPress CSS JS Manager Plugin <= 2.4.49 is vulnerable to Cross Site Request Forgery (CSRF)

Software CSS JS Manager Type Plugin Vulnerable versions = 2.4.49 Fixed in 2.4.49.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-47154 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d901e9767d13 Credits rezaduty Require...

CVE-2023-0895: Improper Neutralization of Special Elements used in an SQL Command

The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

AZL-13604 CVE-2023-23936 affecting package nodejs for versions less than 16.19.1-1

Undici is an HTTP/1.1 client for Node.js. Starting with version 2.0.0 and prior to version 5.19.1, the undici library does not protect host HTTP header from CRLF injection vulnerabilities. This issue is patched in Undici v5.19.1. As a workaround, sanitize the headers.host string before passing to...