CVE-2020-13649: NULL Pointer Dereference

parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scannerreverseinfolist NULL pointer dereference and a scannerscanall assertion failure...

CVE-2020-6830

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for...

CVE-2020-6830

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for...

Code injection

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for...

CVE-2020-6830

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for...

Denial Of Service (DoS)

jpeg-js is vulnerable to denial of service DoS. The vulnerability exists as it fails to properly restrict the values of the resolution from the EXIF data, allowing a small manipulated image to cause a disproportionately large memory allocation...

PT-2020-5579

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 25 Description The issue is related to the implementation of window.webkit in the Firefox web browser for iOS, which involves the disclosure of information about the SECURITY TOKEN. This could allow a remote...

CVE-2020-6830: Exposure of Sensitive Information to an Unauthorized Actor

For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for...

CVE-2020-8020

A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb...

CVE-2020-8020: Improper Neutralization of Input During Web Page Generation

A Improper Neutralization of Input During Web Page Generation vulnerability in open-build-service allows remote attackers to store arbitrary JS code to cause XSS. This issue affects: openSUSE open-build-service versions prior to 7cc32c8e2ff7290698e101d9a80a9dc29a5500fb...

Denial Of Service (DoS)

js-quantities is vulnerable to denial of service DoS attacks through out-of-memoryOOM.The vulnerability exists due to the function parse in quantities.js which does not properly handle unsanitized user inputs.An attacker can exploit this flaw by inserting evil input strings, leading to an...

DuckDuckGo: DOM XSS on duckduckgo.com search

Hello, The is a DOM XSS vulnerability on https://duckduckgo.com search through the norw parameter. PoC URL: https://duckduckgo.com/?q=a&norw=" Screenshot: F820482 Impact The attacker can execute JS code...

stdweb is unmaintained

The author of the stdweb crate is unresponsive. Maintained alternatives: - wasm-bindgen - js-sys - web-sys...

RUSTSEC-2020-0056 stdweb is unmaintained

The author of the stdweb crate is unresponsive. Maintained alternatives: - wasm-bindgen - js-sys - web-sys...

1st_test_yamineo (0.1.0), @akaterra.co/apidog (>=0.0.4, <=0.0.5) +884 more potentially affected by unknown CVE via markdown (>=0.1.2, <=0.5.0)

markdown NPM version =0.1.2, =0.0.4, =0.0.102, =0.1.0, =0.4.0, =0.0.5, =2.1.1, =2.0.0, =0.0.2, =2.1.1, =2.1.1, =2.1.1, =2.1.1, =2.9.14 and more Source cves: unknown CVE Source advisory: SNYK:JS-MARKDOWN-560793...

uglify-js bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

Information Disclosure

auth0.js is vulnerable to information disclosure. Error objects are returned by the library containing confidential information such as the original request of the user or the plaintext password entered by the user...

Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...

@apim/auth0-lock-redux (>=1.0.0, <=1.0.2), @auth0/cordova (>=0.1.0, <=0.2.0) +111 more potentially affected by CVE-2020-5263 via auth0-js (>=8.0.0-beta.1, <=9.13.1)

auth0-js NPM version =8.0.0-beta.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =0.1.0-latest.1a450bb3, =1.4.5-next.1, =2.2.0, =1.0.0, =0.1.0, =0.3.0, =0.8.0 and more Source cves: CVE-2020-5263 Source advisory: OSV:GHSA-PRFQ-F66G-43MP...

GHSA-PRFQ-F66G-43MP Information disclosure through error object in auth0.js

Overview Between versions 8.0.0 and 9.13.1inclusive, in the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the error object is exposed or logged without modification...