PT-2022-12651

Name of the Vulnerable Software and Affected Versions JerryScript version 3.0.0 Description The issue is related to an assertion failure in JerryScript. Specifically, the assertion 'page p != NULL' fails at the parser list get function in the js-parser-mem.c file. Recommendations For JerryScript...

CVE-2021-46170

An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...

Design/Logic Flaw

An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...

CVE-2021-46170

CVE-2021-46170 describes a Use-After-Free in JerryScript’s lexer_compare_identifier_to_string (js-lexer.c) from commit a6ab5e9. The vulnerability is reported across multiple feeds (NVD, OSV, CNVD, UBuntu OSV, Debian, etc.). Affected component is the JerryScript JavaScript engine; root cause is a ...

CVE-2021-46170

An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...

CVE-2021-46170

An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...

CVE-2021-46170

Removed by vendor...

PT-2022-12602

Name of the Vulnerable Software and Affected Versions JerryScript version a6ab5e9 Description An issue was discovered in the js-lexer.c file, specifically in the lexer compare identifier to string function, where there is a Use-After-Free. Recommendations For JerryScript version a6ab5e9, consider...

CVE-2021-46170: Use After Free

An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...

GHSA-RRGW-3HG3-9X8C XSS vulnerability in translations

Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack...

XSS vulnerability in translations

Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack...

PT-2022-28278

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned, so the information cannot be provided. Description The issue allows an attacker with admin privileges and access to Translations management functionality to add a JS payload to translation values...

PT-2022-8881

Name of the Vulnerable Software and Affected Versions cscms version 4.1 Description The issue allows for SQL injection via the js del function. This enables potential attackers to inject malicious SQL code, which could lead to unauthorized access or manipulation of database content. Recommendatio...

GHSA-C6H4-GC3F-HGJQ Prototype Pollution in js-data

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442...

js-data-dao (1.0.0) potentially affected by CVE-2021-23574 via js-data (3.0.0-rc.5)

js-data NPM version 3.0.0-rc.5 is affected by a known vulnerability. The following packages have a transitive dependency on js-data and may be impacted: - js-data-dao 1.0.0 Source cves: CVE-2021-23574 Source advisory: OSV:GHSA-C6H4-GC3F-HGJQ...

js-data-dao (1.0.0) potentially affected by CVE-2021-23574 via js-data (3.0.0-rc.5)

js-data NPM version 3.0.0-rc.5 is affected by a known vulnerability. The following packages have a transitive dependency on js-data and may be impacted: - js-data-dao 1.0.0 Source cves: CVE-2021-23574 Source advisory: GHSA-C6H4-GC3F-HGJQ...

CVE-2021-43852 JavaScript Prototype Pollution in oro/platform

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are...

CVE-2021-43852

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are...

CVE-2021-43852

CVE-2021-43852 (OroPlatform) : A prototype pollution flaw allows an attacker to inject properties into JavaScript prototypes (e.g., Object prototypes) via specially crafted requests, potentially enabling JS code execution by vulnerable libraries. The issue is mitigated by patching to version 4.2....

CVE-2021-43852: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are...