PT-2022-36950

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state indicates the involvement of JavaScri...

AZL-45141 CVE-2022-0436 affecting package js-jquery 3.5.0-4

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2...

gogs -- XSS in issue attachments

The gogs project reports: Repository issues page allows HTML attachments with arbitrary JS code...

CVE-2021-43453

A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parserparseforstatementstart in the js-parser-statm.c file. This issue is similar to CVE-2020-29657...

CVE-2021-43453

A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parserparseforstatementstart in the js-parser-statm.c file. This issue is similar to CVE-2020-29657...

CVE-2021-43453

Removed by vendor...

CVE-2021-43453: Out-of-bounds Read

A Heap-based Buffer Overflow vulnerability exists in JerryScript 2.4.0 and prior versions via an out-of-bounds read in parserparseforstatementstart in the js-parser-statm.c file. This issue is similar to CVE-2020-29657...

JerryScript 缓冲区错误漏洞

JerryScript is a lightweight JavaScript engine from the Jerryscript project. JerryScript 2.4.0 suffers from a buffer error vulnerability that originates from an out-of-bounds read via parserparseforstatementstart in the js-parser-statm.c file...

CVE-2021-38834

easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...

CVE-2022-24814

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

PT-2022-16894

Name of the Vulnerable Software and Affected Versions Directus versions prior to 9.7.0 Description The issue allows unauthorized JavaScript to be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file, which loads another uploaded JS file in its...

CVE-2022-24794

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the "requiresAuth" middleware, either directly or through the default "authRequired" option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...

CVE-2022-24794

Express OpenID Connect (express-openid-connect) CVE-2022-24794 describes an Open Redirect vulnerability when requiresAuth is applied on a catch-all route. Affected versions are prior to 2.7.2. The issue arises because the original URL reported by the Express framework is not properly sanitized, a...

CVE-2022-24794: URL Redirection to Untrusted Site

Express OpenID Connect is an Express JS middleware implementing sign on for Express web apps using OpenID Connect. Users of the requiresAuth middleware, either directly or through the default authRequired option, are vulnerable to an Open Redirect when the middleware is applied to a catch all...

Backdoor.Win32.Chubo.c Cross Site Scripting

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/c16b04a9879896ef453a6deb13528087B.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Chubo.c Vulnerability: Cross Site Scripting XSS Family: Chubo Type: Web Panel MD5:...

GHSA-5W9C-RV96-FR7G Removal of functional code in faker.js

Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to the colors.js CVE-2021-23567. The...

AZL-44583 CVE-2021-44906 affecting package js-jquery 3.5.0-4

Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95...

Improper Input Validation

url-js is vulnerable to improper input validation. The vulnerability exists in parseUrl function in parseUrl.js because the inputs are not parsed properly which allows an attacker to perform host name spoofing...

GHSA-RF54-44JR-Q5VF Improper Input Validation in url-js

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...

CVE-2022-25839

The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is...