MAL-2024-8861 Malicious code in cryptograph-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344b01183d31f7bfbadedba12b2bfe4e733ea76938ea8976787f6c400b39f5a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-78VG-7V27-HJ67 auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

Summary Unescaped entity property enables Javascript injection. Details I think this is possible because %sourcelabel% in twig macro is not escaped. Therefore script tags can be inserted and are executed. PoC - clone example project https://github.com/DamienHarper/auditor-bundle-demo - create...

CVE-2024-43412 Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS

Xibo is an open source digital signage platform with a web content management system CMS. Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xib...

CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4

CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4. A patched version of the package is available...

PT-2024-30196 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions 6.6.2 and earlier Description: An issue in the js localize.php function allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js localize.php function. This issue enables...

LimeSurvey 安全漏洞

LimeSurvey PHPSurveyor is a set of open source online questionnaire survey program from LimeSurvey team, which supports survey program development, questionnaire publishing and data collection. A security vulnerability exists in LimeSurvey version v6.6.2 and earlier versions, which stems from an...

ua-parser-js npm module ReDenial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ua-parser-js npm module ReDoS', 'Description' = %q This module exploits a Regular Expression Denial of Service vulnerability in the npm module...

CVE-2024-41444

SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so...

Simple College Website 1.0 SQL Injection / Code Execution

============================================================================================================================================= | Title : Simple College Website 1.0 WYSIWYG Settings Management Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla...

PT-2024-29404

Name of the Vulnerable Software and Affected Versions SeaCMS versions 11.3 through 12.9 Description The issue is a SQL injection vulnerability in the key parameter of the "/js/player/dmplayer/dmku/index.php?ac=so" endpoint. This vulnerability can be exploited to inject malicious SQL code. Users a...

CVE-2024-41444: Improper Neutralization of Special Elements used in an SQL Command

SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so...

Exploit for Type Confusion in Google Chrome

CVE-2024-1939 This is a short writeup for the CVE-2024-1939,...

io.undertow.js:undertow-js (>=1.0.0.alpha3, <=1.1.0.beta1), io.undertow.js:undertow-js-freemarker (1.1.0.beta1) +69 more potentially affected by CVE-2024-7885 via io.undertow:undertow-core (1.3.0.beta6)

io.undertow:undertow-core MAVEN version 1.3.0.beta6 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow.js:undertow-js =1.0.0.alpha3, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.alpha13, =2.0.0.beta1 ...

Uncontrolled Recursion

matrix-js-sdk is vulnerable to Uncontrolled Recursion. The vulnerability is caused due to an infinite recursion in getRoomUpgradeHistory function causing the code to hang. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle and also by calling...

CVE-2024-43396 Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in...

CVE-2024-43396

CVE-2024-43396 concerns Khoj, an open-source app for personal AI agents. The vulnerability is a Stored XSS in the Automation feature caused by insufficient sanitization of the q parameter in the /api/automation endpoint, allowing injection of arbitrary HTML/JS when the payload is rendered on the ...

matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor

Impact A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain' method, so...

GHSA-VHR5-G3PM-49FM matrix-js-sdk will freeze when a user sets a room with itself as a its predecessor

Impact A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This method is public but also called by the 'leaveRoomChain' method, so...

matrix-react-sdk (>=3.102.0-rc.0, <=3.106.0) potentially affected by CVE-2024-42369 via matrix-js-sdk (>=34.0.0-rc.0, <=34.3.0)

matrix-js-sdk NPM version =34.0.0-rc.0, =3.102.0-rc.0, =3.106.0 Source cves: CVE-2024-42369 Source advisory: GHSA-VHR5-G3PM-49FM...

CVE-2024-42369

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This...