Inefficient Regular Expression Complexity in faisalman/ua-parser-js

Description Hello my dear I found another inefficient regular expression in ua-parser-js that have a Polynomial execution time not exponential but still dangerous. Proof of Concept I create two payloads that you can compare the execution times between them in Regexr provided links. payload 1...

CVE-2020-14130: Exposure of Resource to Wrong Sphere

Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version 3.0.210809...

serenity:FuzzJs: Bad-cast to AK::Array<AK::TypeErasedParameter, 0>void JS::VM::throw_exception<JS::RangeError> in JS::div

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5819009270939648 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJs Job Type: libfuzzerubsanserenity Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffeb5cd4d78 Crash Stat...

matrix-react-sdk (>=3.24.0-rc.1, <=3.29.0) potentially affected by CVE-2021-40823 via matrix-js-sdk (>=12.0.0, <=12.4.0-rc.1)

matrix-js-sdk NPM version =12.0.0, =3.24.0-rc.1, =3.29.0 Source cves: CVE-2021-40823 Source advisory: OSV:GHSA-23CM-X6J7-6HQ3...

matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver

Impact A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-en...

Privilege Escalation

matrix-js-sdk is vulnerable to privilege escalation. The vulnerability exists due to lack of identity verification which allows a key-requesting device to be impersonated...

EulerOS 2.0 SP2 : python-lxml (EulerOS-SA-2021-2431)

According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different...

CVE-2021-40823

A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were originally sent by affected Matrix clients...

CVE-2021-40823

A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were originally sent by affected Matrix clients...

CVE-2021-40823

CVE-2021-40823 affects matrix-js-sdk and related Element client variants. A logic error in the room key sharing functionality prior to version 12.4.1 allows a malicious Matrix homeserver participating in an encrypted room to steal room encryption keys originally sent by affected clients, enabling...

@blerpapp/js-data-cloud-datastore (>=1.0.0-rc.2, <=1.0.0-rc.3), @citygro/vdata (>=5.0.0, <=8.10.0) +90 more potentially affected by CVE-2020-28442 +1 more via js-data (>=0.4.2, <=4.0.0-beta.4)

js-data NPM version =0.4.2, =1.0.0-rc.2, =5.0.0, =0.3.27, =0.3.0, =1.0.2, =1.0.0, =0.1.0, =0.1.2, =2.1.30, =1.2.15-alpha, =0.2.5, =1.0.0, =1.3.1 - api-fusion 0.1.2 and more Source cves: CVE-2020-28442, CVE-2021-23574 Source advisory: SNYK:JS-JSDATA-1584361...

Prototype Pollution

Overview js-data is a Robust, framework-agnostic in-memory data store. Affected versions of this package are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442. PoC 1 var jsdata = require'js-data'; var obj = ; var payload =...

PT-2021-22960

Name of the Vulnerable Software and Affected Versions matrix-js-sdk versions prior to 12.4.1 Element Web versions 1.8.2 and earlier Element Desktop versions 1.8.2 and earlier SchildiChat Web versions 1.7.32-sc1 and earlier SchildiChat Desktop versions 1.7.32-sc1 and earlier Cinny versions 1.2.0 a...

CVE-2021-40823: Authentication Bypass by Spoofing

A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys via crafted Matrix protocol messages that were originally sent by affected Matrix clients...

nodejs-lodash: command injection via template

A flaw was found in nodejs-lodash. A command injection flaw is possible through template variables...

XSS vulnerability on contacts view

Impact Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populat...

GHSA-72HM-FX78-XWHC XSS vulnerability on contacts view

Impact Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populat...

XSS vulnerability on asset view

Impact Mautic versions before 3.3.4 / 4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets. Patch...

GHSA-RH5W-82WH-JHR8 XSS vulnerability on asset view

Impact Mautic versions before 3.3.4 / 4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets. Patch...

GHSA-9GR3-7897-PP7M XSS in Image Optimization API for Next.js

Impact - Affected: All of the following must be true to be affected - Next.js between version 10.0.0 and 11.1.0 - The next.config.js file has images.domains array assigned - The image host assigned in images.domains allows user-provided SVG - Not affected: The next.config.js file has images.loade...