PT-2022-4608

Name of the Vulnerable Software and Affected Versions matrix-js-sdk versions prior to 19.4.0 Description The issue is related to errors in handling input data, which can allow a remote attacker to perform a denial-of-service DoS attack. Events sent with special strings in key places can temporari...

CVE-2022-35583

wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial asset IP address on it's source. This allows the attacker to takeover the whole infrastructure by accessing their internal assets...

Malicious code in baes64-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb61cde988829a5d1b10b6a368cd46493e6369683fff55a5b1ef19fd407f187c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1453 Malicious code in baes64-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb61cde988829a5d1b10b6a368cd46493e6369683fff55a5b1ef19fd407f187c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-F772-66G8-Q5H3 Nodejs ‘undici’ vulnerable to CRLF Injection via Content-Type

Impact = [email protected] users are vulnerable to CRLF Injection on headers when using unsanitized input as request headers, more specifically, inside the content-type header. Example: import request from 'undici' const unsanitizedContentTypeInput = 'application/json\r\n\r\nGET /foo2 HTTP/1.1' await...

CVE-2021-42052: Improper Limitation of a Pathname to a Restricted Directory

IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter...

PT-2022-11536

Name of the Vulnerable Software and Affected Versions IPESA e-Flow version 3.3.6 Description The issue allows path traversal for reading any file within the web root directory. This is achieved via the lib/js/build/STEResource.res path and the R query parameter. Recommendations For IPESA e-Flow...

WordPress plugin JS Help Desk 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in WordPress plugin JS...

CVE-2022-34768

CVE-2022-34768 allows injection of HTML/JavaScript into the “Workers > worker nickname” input. Affected component: the input field used for worker nicknames; root cause is input handling that permits code insertion. Impact as per NVD: base CVSS v3.1 = 7.5 (HIGH), with I = HIGH, C/N? per vector...

CVE-2022-34768: Improper Neutralization of Input During Web Page Generation

insert HTML / js code inside input how to get to the vulnerable input : Workers worker nickname inject in this input the code...

MAL-2022-1184 Malicious code in avax-js-cli-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20bcbb8282cba23d9c896b37231cedc6bae3b5042eff2693e1ee677525401345 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin JS Help Desk 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress plugin...

Design/Logic Flaw

The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them...

Node.js 信任管理问题漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A trust management issue vulnerability exists in fs2 on Node.js, which stems from the fact that when fs2-io is used to establish a server-mode TLSSocket on Node.js, it ignores the parameter requestCert = true, skips the...

[SECURITY] Fedora 36 Update: golang-github-tdewolff-minify-2.11.10-4.fc36

Minify is a minifier package written in Go. It provides HTML5, CSS3, JS, JSON, SVG and XML minifiers and an interface to implement any other minifier. Minification is the process of removing bytes from a file such as whitespace without changing its output and therefore shrinking its size and...

CVE-2022-34988

Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the component /admin/js...

Prototype Pollution

js-ini is vulnerable to prototype pollution. The vulnerability exists in parse function in index.ts and parse.ts due to lack of validations which allows an attacker to send malicious INI files on the application to cause a pollution on prototype...

GHSA-M939-VRFP-9V8P js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse`

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...

PT-2022-22472

Name of the Vulnerable Software and Affected Versions Inout Blockchain AltExchanger version 1.2.1 Description A cross-site scripting XSS issue was found in the /admin/js component. This allows for potential malicious script execution. Recommendations For Inout Blockchain AltExchanger version 1.2....

CVE-2022-34988: Improper Neutralization of Input During Web Page Generation

Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the component /admin/js...