AZL-44583 CVE-2021-44906 affecting package js-jquery 3.5.0-4

Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95...

Improper Input Validation

url-js is vulnerable to improper input validation. The vulnerability exists in parseUrl function in parseUrl.js because the inputs are not parsed properly which allows an attacker to perform host name spoofing...

GHSA-RF54-44JR-Q5VF Improper Input Validation in url-js

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

CVE-2022-25839

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

Input validation

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

coherent-gameface-router (>=1.0.1, <=3.1.0), redirect-nginx-generator (1.0.0) potentially affected by CVE-2022-25839 via url-js (0.2.6)

url-js NPM version 0.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on url-js and may be impacted: - coherent-gameface-router =1.0.1, =3.1.0 - redirect-nginx-generator 1.0.0 Source cves: CVE-2022-25839 Source advisory: MEND:CVE-2022-25839...

CVE-2022-25839

The CVE concerns the JavaScript package url-js prior to version 2.1.0 . The vulnerability arises from improper input validation during parsing in the URL.js parser, allowing hostname spoofing (for example, both http://\\\\localhost and http://localhost are treated as the same URL, with the backsl...

CVE-2022-25839

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

CVE-2022-25839 Improper Input Validation

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

SUSE SLED15 / SLES15 Security Update : python-lxml (SUSE-SU-2022:0803-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0803-1 advisory. - An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remo...

PT-2022-17562

Name of the Vulnerable Software and Affected Versions url-js versions prior to 2.1.0 Description The issue arises from improper input validation due to incorrect parsing. This allows the hostname to be spoofed, as seen in the comparison between http://localhost and http://localhost, which are...

CVE-2022-25839: Improper Input Validation

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

Accepting arbitrary Subject Alternative Name (SAN) types unless a PKI is specifically defined to use a particular SAN type can result in bypassing name-constrained intermediates. Node.js < 12.22.9 < 14.18.3 < 16.13.2 and < 17.3.1 was accepting URI SAN types which PKIs are often not defined to use. Additionally when a protocol allows URI SANs Node.js did not match the URI correctly.Versions of Node.js with the fix for this disable the URI SAN type when checking a certificate against a hostname. This behavior can be reverted through the --security-revert command-line option.

...

CVE-2022-0422

The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue...

PT-2022-13171

Name of the Vulnerable Software and Affected Versions White Label CMS WordPress plugin versions prior to 2.2.9 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the wlcms login custom js parameter is not properly sanitised and validated before being...

CVE-2022-0868

Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10...

UBUNTU-CVE-2022-21824

Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...

SUSE-SU-2022:0563-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe bsc1192153. - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite bsc1191963. - CVE-2021-32804: Fixed...

PT-2022-13350

Name of the Vulnerable Software and Affected Versions radare2 versions prior to 5.6.4 radare2.js versions prior to 5.6.4 Description A Heap-based Buffer Overflow issue has been identified. The estimated number of potentially affected devices and details about real-world incidents are not provided...

Security Bulletin: IBM Aspera Shares 1.9.14 Patch Level 1 and earlier are vulnerable to DOM XSS

Summary DOM XSS on IBM Aspera Shares 1.9.14 Patch Level 1 and earlier could lead to HTML/JS injection and Account takeover. Vulnerability Details CVEID: CVE-2020-4731 DESCRIPTION: IBM Aspera Web Application is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...