11 matches found
CVE-2026-34211 SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parser
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, the @nyariv/sandboxjs parser contains unbounded recursion in the restOfExp function and the lispify/lispifyExpr call chain. An attacker can crash any Node.js process that parses untrusted input by supplying deeply nested expressions...
@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @mieweb/wikigdrive (>=2.15.0, <=2.17.1) +3 more potentially affected by CVE-2026-34211 via @nyariv/sandboxjs (>=0.5.3, <=0.8.25)
@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =2.15.0, =0.2.0, =11.0.0, =12.0.1 Source cves: CVE-2026-34211 Source advisory: SNYK:JS-NYARIVSANDBOXJS-15909754...
CVE-2024-34211
TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root...
CVE-2024-34211
The TOTOLINK CP450 (v4.1.0cu.747_B20191224), an outdoor wireless client terminal, contains a hardcoded password vulnerability located in the /etc/shadow.sample file. An attacker can exploit this flaw to gain root access to the device. As a remediation, users are advised to change the hardcoded pa...
CVE-2024-34211
TOTOLINK CP450 v4.1.0cu.747B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root...
CVE-2023-34211
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none...
CVE-2022-34211
A cross-site request forgery CSRF vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL...
CVE-2022-34211
CVE-2022-34211 describes a CSRF in the Jenkins vRealize Orchestrator Plugin (versions 3.0 and earlier) where an attacker can induce the plugin’s HTTP endpoint to perform a POST to a URL of the attacker’s choosing. The root cause is a lack of permission checks on the vulnerable HTTP endpoint, enab...
CVE-2022-34211
A cross-site request forgery CSRF vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL...
