6884 matches found
PT-2022-22472
Name of the Vulnerable Software and Affected Versions Inout Blockchain AltExchanger version 1.2.1 Description A cross-site scripting XSS issue was found in the /admin/js component. This allows for potential malicious script execution. Recommendations For Inout Blockchain AltExchanger version 1.2....
CVE-2020-28461
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...
Code injection
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...
CVE-2020-28461
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...
CVE-2020-28461
CVE-2020-28461 affects the js-ini package before 1.3.0. The vulnerability is a prototype pollution issue in the parse function when parsing untrusted INI-like inputs, enabling an attacker to contaminate the application prototype. Impact is context-dependent and not quantified in all sources, but ...
CVE-2020-28461 Prototype Pollution
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...
CVE-2020-28461: Improperly Controlled Modification of Object Prototype Attributes
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context...
PT-2022-8903 · Js-Ini · Js-Ini
Name of the Vulnerable Software and Affected Versions: js-ini versions prior to 1.3.0 Description: The issue arises when an attacker submits a malicious INI file to an application that uses the parse function to parse it. This can lead to prototype pollution on the application, which can be furth...
Information disclosure
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information...
CVE-2020-14114
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information...
CVE-2020-14126
Technical details about CVE-2020-14126 are not provided in the connected documents. Public information in the initial entry notes information leakage via illegal JS interface calls, but no concrete affected products, versions, root cause, impact, or fixes are disclosed here. Monitor for updates.
CVE-2020-14126
Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information...
GHSA-MHXJ-85R3-2X55 file-type vulnerable to Infinite Loop via malformed MKV file
An issue was discovered in the file-type package from 13.0.0 until 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack when...
PT-2022-8558
Name of the Vulnerable Software and Affected Versions Mi Sound APP affected versions not specified Description The issue is caused by illegal calls to sensitive JS interfaces, allowing attackers to leak sensitive information. Recommendations At the moment, there is no information about a newer...
PT-2022-8549
Name of the Vulnerable Software and Affected Versions Xiaomi SmartHome APP affected versions not specified Description The issue is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information. Recommendations At the moment, there is n...
CVE-2020-14114: Undefined Security Weakness
information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information...
CVE-2020-14126: Undefined Security Weakness
Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information...
nodejs-json-schema: Prototype pollution vulnerability
The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...
@intlgadmin/skywalking-nodejs-prisma-plugin (1.0.0), logtube (>=2.3.0, <=2.4.0) +3 more potentially affected by CVE-2022-36127 via skywalking-backend-js (>=0.3.0, <=0.4.1)
skywalking-backend-js NPM version =0.3.0, =2.3.0, =1.2.144-2, =1.0.0, =1.0.4 Source cves: CVE-2022-36127 Source advisory: OSV:GHSA-8GPG-466C-5CPJ...
