Fedora: Security Advisory for golang-github-tdewolff-minify (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-30622 Chcnav - P5E GNSS Information disclosure

Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sysusernamepasswd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within...

[SECURITY] Fedora 35 Update: golang-github-tdewolff-minify-2.11.10-3.fc35

Minify is a minifier package written in Go. It provides HTML5, CSS3, JS, JSON, SVG and XML minifiers and an interface to implement any other minifier. Minification is the process of removing bytes from a file such as whitespace without changing its output and therefore shrinking its size and...

AZL-44553 CVE-2022-25858 affecting package js-jquery 3.5.0-4

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure usage of regular expressions...

OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager Relates to - https://github.com/artf/grapesjs/issues/4411 Patch Update GrapeJS dependency to =v0.19.5...

PT-2022-28207

Name of the Vulnerable Software and Affected Versions GrapeJS versions prior to 0.19.5 Description The issue is due to insufficient class name validation in the GrapeJS library, allowing executable JS code to be added in the class name through the Selector Manager. Recommendations For versions...

DEBIAN-CVE-2022-32214

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...

UBUNTU-CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

UBUNTU-CVE-2022-32215

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS...

UBUNTU-CVE-2022-32212

A OS Command Injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks...

Malicious code in ugentec-framework-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a91b6a72d36e1f86952649dd1acf051dd8bc358d059c4ebe50b229b77170ece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the Node.js module and the control tools of App Connect Enterprise Certified Container allows a hacker to compromise protected information.

The vulnerability of the Node.js module related to the App Connect Enterprise Certified Container management tool is linked to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to compromise protected information...

PT-2022-37080

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 4 crash has been reported. The crash occurs in the following functions: emit goto, js parse for in of, and js parse statement o...

Malicious code in vue3-babel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5cac02007b4690bac994eb4568b35a36b6b8e314560aaec41466da2895e6fd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6999 Malicious code in vue3-babel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5cac02007b4690bac994eb4568b35a36b6b8e314560aaec41466da2895e6fd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

parse-url cross-site scripting vulnerability

parse-url is an advanced url parser with git url support. A cross-site scripting vulnerability exists in parse-url versions prior to 7.0.0, which stems from the ability to run malicious JS code using ASCII characters starting with and all special escape characters starting with Unicode, which can...

PT-2022-3606

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 14.20.1 Node.js versions prior to 16.17.1 Node.js versions prior to 18.9.1 Description The issue is related to the llhttp parser in the http module in Node.js, which does not strictly use the CRLF sequence to delimit...

Malicious code in ionicons-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9725c2ec0d19615a1adbf6262aa004b3b33803b68c6e24ff76a29f4d21a59d37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3933 Malicious code in ionicons-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9725c2ec0d19615a1adbf6262aa004b3b33803b68c6e24ff76a29f4d21a59d37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora: Security Advisory for golang-github-tdewolff-minify (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...