6884 matches found
WS-2019-0457
Ngx-context-menu v0.0.26 contains malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0438
All versions of js-regular contains malicious code. The package uploaded system information such as OS and hostname to a remote server...
WS-2019-0437
All versions of js-base64-int contains malicious code. The package uploaded system information such as OS and hostname to a remote server...
WS-2019-0432
Grunt-radical, version 0.0.14 contains malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0413
crpyto-js was designed to find and exfiltrate cryptocurrency wallets...
WS-2019-0406
cage-js contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script...
WS-2019-0389
Angular-location-update, version 0.0.3 contains malicious code that gets executed in the browser and enumerates password, cvc and cardnumber fields from forms and sends the extracted values to "hps://js-metrics.com/minjs.php?pl="...
WS-2019-0386
@fangrong/xoc version 1.0.6 contains malicious code which steals sensitive information such as cardnumbers and passwords from forms in the browser and send them to "hps://js-metrics.com/minjs.php?pl="...
WS-2018-0625
The package xmlbuilder-js before 9.0.5 is vulnerable to denial of service due to a regular expression issue...
WS-2020-0050
1337qq-js is a malicious package, on Unix systems the package allows remote attackers to disclose sensitive information...
WS-2020-0010
All versions of simple-crypto-js use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data...
WS-2019-0341
Cross-Site Scripting vulnerability found in nextcloud-vue-collections before 0.4.2. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's...
WS-2019-0316
In saml2-js, versions prior to v2.0.5 are vulnerable to authentication bypass due the failure of enforcement of assertion conditions...
WS-2019-0208
bpmn-js-properties-panel before 0.31.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...
WS-2019-0207
cmmn-js-properties-panel before 0.8.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...
WS-2019-0206
dmn-js-properties-panel before 0.3.0 vulnerable to XSS attack when failing to sanitize input in specially configured diagrams...
WS-2019-0175
diagram-js versions 2.x before 2.6.2 and 3.x before 3.3.1 fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript...
WS-2019-0148
diagram-js-direct-editing versions before 1.4.3 fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser...
@dotgov/bpmn (>=0.0.1, <=0.0.29), @dotgov/z_bpmn (>=0.0.1, <=2.0.0) +14 more potentially affected by unknown CVE via diagram-js-direct-editing (>=0.4.0, <=0.23.0)
diagram-js-direct-editing NPM version =0.4.0, =0.0.1, =0.0.1, =1.0.0, =0.5.0, =1.20.7, =0.7.2, =1.0.0, =1.0.0, =0.2.2, =0.0.7, =2.0.0, =2.2.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0148...