MAL-2023-1118 Malicious code in aws-sdk-js-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e64c49f08b91cb456113ae44bbd8efc8280a1c79aa45ca1bd0f019c4af6ad873 The OpenSSF Package Analysis project identified 'aws-sdk-js-v3' @ 1.3.7 npm as malicious. It is considered malicious because: - The package...

PT-2023-26484 · Node.Js · Sails

Name of the Vulnerable Software and Affected Versions: Sails versions prior to 1.5.7 Description: Sails is a realtime MVC Framework for Node.js. An attacker can send a virtual request that will cause the node process to crash. Recommendations: For versions prior to 1.5.7, update to version 1.5.7 ...

CVE-2023-26045

NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to...

PT-2023-12956 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct version 22 Description: An issue was discovered in the Administration of Measurements website section, where a malicious user can edit or add the templateName parameter to include JavaScript code. This code is then stored and...

Design/Logic Flaw

ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount...

Stack overflow

ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray...

Design/Logic Flaw

ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray...

CVE-2023-37141

ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray...

CVE-2023-37142

ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees...

CVE-2023-37139

ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray...

CVE-2023-37142

CVE-2023-37142 is a ChakraCore vulnerability where a segmentation violation occurs in Js::EntryPointInfo::HasInlinees() on the master branch (cbb9b). The incident is documented with a CVSSv3.1 base score of 5.5 (MEDIUM) with LOCAL attack vector, LOW attack complexity, no privileges required, user...

CVE-2023-37141

ChakraCore (branch master cbb9b) is affected by a segmentation violation in the function Js::ProfilingHelpers::ProfiledNewScArray(). The vulnerability causes a crash (local impact) and is tied to the ChakraCore engine’s profiling array creation. Affected version is stated as cbb9b; no explicit ex...

CVE-2023-37139

ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray...

CVE-2023-37140

ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount...

PT-2023-25803

Name of the Vulnerable Software and Affected Versions ChakraCore branch master cbb9b Description A segmentation violation was discovered in ChakraCore via the function Js::EntryPointInfo::HasInlinees. Recommendations For ChakraCore branch master cbb9b, consider disabling the...

CVE-2023-37142

ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees...

PT-2023-25801

Name of the Vulnerable Software and Affected Versions ChakraCore version cbb9b Description A segmentation violation was discovered in ChakraCore via the function Js::DiagScopeVariablesWalker::GetChildrenCount. Recommendations For version cbb9b, consider disabling the...

CVE-2023-37140

ChakraCore (branch master) contains a segmentation fault in Js::DiagScopeVariablesWalker::GetChildrenCount(), per CVE-2023-37140. Affected component: ChakraCore JavaScript engine; root cause: segmentation violation in the mentioned function. Documented impact indicates local attack vector with av...

CVE-2023-37141: Uncontrolled Resource Consumption

ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray...

CVE-2023-37139: Out-of-bounds Write

ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray...