CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

DEBIAN-CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

UBUNTU-CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729 Arbitrary Code Execution

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

Summary: CVE-2020-7729 affects the grunt package due to insecure YAML loading via js-yaml in grunt.file.readYAML, allowing arbitrary code execution. The issue is triggered by using load() instead of safeLoad(). The vulnerability is discussed across multiple sources, including npm advisory, Ubuntu...

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

Denial Of Service (DoS)

serialize-to-js is vulnerable to denial of service DoS. The vulnerability exists as the unvalidated user input could cause an infinite loop in the deserialize function...

GHSA-48HW-37G6-3GW4 Malicious Package in mx-nested-menu

Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluat...

GHSA-GJC9-932X-C59P Malicious Package in leaflet-gpx

Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate yo...

Malicious Package in jekyll-for-github-projects

Version 0.2.12 of jekyll-for-github-projects contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment...

PT-2020-20943

Name of the Vulnerable Software and Affected Versions rc cal version 0.1.1 Description The issue concerns malicious code in version 0.1.1 of rc cal. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted values to...

PT-2020-21335

Name of the Vulnerable Software and Affected Versions dmn-js-properties-panel versions prior to 0.8.0 Description The issue arises from the failure to sanitize input in specially configured diagrams, potentially allowing attackers to inject arbitrary JavaScript into the embedding website. This ca...

PT-2020-21402

Name of the Vulnerable Software and Affected Versions saml2-js versions prior to 2.0.5 Description The issue is related to an Authentication Bypass in the saml2-js package. It fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted...

PT-2020-21048

Name of the Vulnerable Software and Affected Versions vue-backbone version 0.1.2 Description The issue concerns malicious code in version 0.1.2 of vue-backbone. When executed in a browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the extracted values to the...

PT-2020-21070

Name of the Vulnerable Software and Affected Versions simple-crypto-js versions prior to 2.3.0 Description The issue concerns the use of AES-CBC with PKCS7 padding, which is susceptible to padding oracle attacks. This could potentially allow attackers to break the encryption and access sensitive...

PT-2020-21150

Name of the Vulnerable Software and Affected Versions larvitbase-www versions affected versions not specified Description The issue concerns an Unintended Require in the package, which exposes an API endpoint. A GET parameter is passed unsanitized to a require call, allowing attackers to execute...

PT-2020-21371

Name of the Vulnerable Software and Affected Versions cage-js versions all Description The issue concerns malicious code in the software that downloads and runs a script from a remote server as a postinstall script. Any computer with this package installed should be considered fully compromised,...

PT-2020-21528

Name of the Vulnerable Software and Affected Versions bpmn-js-properties-panel versions prior to 0.31.0 Description The issue is related to Cross-Site Scripting XSS due to the failure to sanitize input in specially configured diagrams. This may allow attackers to inject arbitrary JavaScript in th...