TrueConf Server 跨站脚本漏洞

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server contains a cross-site scripting vulnerability that can be exploited by remote attackers to perform basic cross-site scripting DOM attacks...

CVE-2022-31103

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

Denial of service

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

CVE-2022-31103

Lettersanitizer is a DOM-based HTML email sanitizer. All versions below 1.0.2 are affected by a denial-of-service when processing the CSS at-rule @keyframes. The issue also affects React Letter via dependency on lettersanitizer. Root cause: improper handling of CSS at-rules in the sanitizer, lead...

CVE-2022-31103 Improper handling of CSS at-rules in lettersanitizer

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

lettersanitizer 代码问题漏洞

lettersanitizer is a DOM-based HTML email cleaner for in-browser email rendering. A denial of service vulnerability exists in lettersanitizer versions prior to 1.0.2. The vulnerability stems from a failure to properly handle incoming error messages and can be exploited by an attacker to cause a...

Malicious Package

Overview react-dom-router-old is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

CVE-2022-23077

In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page...

Hardcoded credentials

In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page...

CVE-2022-23077

Habitica (HabitRPG) versions 4.119.0–4.232.2 are affected by a DOM-based XSS on the login page. Root cause: insufficient validation/escaping of user-supplied data leading to reflected input in the DOM. Impact: cross-site scripting via the login page; potential for session/credential exposure if u...

CVE-2022-23077 Habitica - DOM XSS in login page

In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page...

CVE-2022-23077 Habitica - DOM XSS in login page

In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page...

Malicious code in wm-jquery-shadow-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cce2934c0da39a0931ddef4e3d88c8f5afb631e708767cf3b4e98ec4dff7464 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7196 Malicious code in wm-jquery-shadow-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cce2934c0da39a0931ddef4e3d88c8f5afb631e708767cf3b4e98ec4dff7464 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in isomsorphic-react-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af5cb42b8400c90362f3b20685e648e98824dfcbfb667b1af00eba3754bdd507 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3969 Malicious code in isomsorphic-react-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af5cb42b8400c90362f3b20685e648e98824dfcbfb667b1af00eba3754bdd507 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in typescript-dom-lib-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75be6711c73ad24a7b04bb490d8390cd6f717b03cc7fcf664e61ee0f52ffa48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6715 Malicious code in typescript-dom-lib-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75be6711c73ad24a7b04bb490d8390cd6f717b03cc7fcf664e61ee0f52ffa48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vendor-react-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63a0b5099ec6bd274fd7bf4c2d20f7862fa2c1352b283b43f8a1f63a79b0ce38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6903 Malicious code in vendor-react-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63a0b5099ec6bd274fd7bf4c2d20f7862fa2c1352b283b43f8a1f63a79b0ce38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...