6890 matches found
Fedora: Security Advisory for js-jquery-ui (FEDORA-2021-013ab302be)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for js-jquery-ui (FEDORA-2021-51c256bf87)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Fedora: Security Advisory for js-jquery-ui (FEDORA-2021-ab38307fc3)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Matrix clients -- several vulnerabilities
Matrix developers report: Today we are releasing security updates to libolm, matrix-js-sdk, and several clients including Element Web / Desktop. Users are encouraged to upgrade as soon as possible. These releases mitigate a buffer overflow in olmsessiondescribe, a libolm debugging function used b...
OS Command injection in docker-cli-js
Withdrawn After reviewing this CVE, and this response from the maintainer, we have withdrawn this advisory. Original CVE description This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will ...
GHSA-FF45-7PRW-58VJ OS Command injection in docker-cli-js
Withdrawn After reviewing this CVE, and this response from the maintainer, we have withdrawn this advisory. Original CVE description This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will ...
Bagisto 1.3.3 - Client-Side Template Injection Vulnerability
Exploit Title: Bagisto 1.3.3 - Client-Side Template Injection Exploit Author: Mohamed Abdellatif Jaber Vendor Homepage: https://bagisto.com/en/ Software Link: https://github.com/bagisto/bagisto Version: v1.3.3 Tested on: windows | chrome | firefox Exploit :. 1- register an account and login your...
Shopify: Reflected XSS online-store-git.shopifycloud.com
Summary: Hello, I hope you are having a good day!, There is a feature called "Shopify Github Integration", it helps to associate a GitHub account to a Shopify store. In the Github connection proccess there is a URL https://online-store-git.shopifycloud.com which is vulnerable to XXS reflected...
Insecure Certificate Validation
aws/aws-iot-device-sdk-js-v2 is vulnerable to Insecure Certificate Validation. Attackers are able to compromise certificate authorities in their trust stores on Linux/Unix, by spoofing DNS records to bypass CA pinning...
CVE-2021-40828
Connections initialized by the AWS IoT Device SDK v2 for Java versions prior to 1.3.3, Python versions prior to 1.5.18, C++ versions prior to 1.12.7 and Node.js versions prior to 1.5.1 did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities CA in...
CVE-2021-23732
This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system...
CVE-2021-23732
This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system...
PT-2021-15548
Name of the Vulnerable Software and Affected Versions docker-cli-js versions all Description The issue affects the Docker.command method in the docker-cli-js package. If a user can partially control the command parameter of this method, they can execute arbitrary OS commands on the host system...
CVE-2021-23732: Improper Neutralization of Special Elements used in an OS Command
This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system...
[SECURITY] Fedora 33 Update: js-jquery-ui-1.13.0-1.fc33
A curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery JavaScript Library...
[SECURITY] Fedora 34 Update: js-jquery-ui-1.13.0-1.fc34
A curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery JavaScript Library...
Auto Featured Image < 3.9.3 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the postid parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue. PoC https://example.com/wp-admin/upload.php?page=menu-media-aptid=alert/XSS/...
Kubernetes: Google storage bucket takeover which is used to load JS file in dashboard.html in "github.com/kubernetes/release" which can lead to XSS
Report Submission Form Summary: Kubernetes have a github repository github.com/kubernetes/release In the repository there is code for dashboard. The dashboard have a html file dashboard.html which is using a JS file from a google storage bucket. The bucket was not registered on google cloud. So I...
Remote Code Execution (RCE)
librenms is vulnerable to remote code execution. A lack of sanitization of user input via the widget title allows an attacker to inject malicious html script or js code into the system...
