6838 matches found
Denial of Service (DoS) in mongo-express
All versions of package mongo-express are vulnerable to Denial of Service DoS when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash...
bem-register (>=1.0.0, <=1.0.5), itstep_server (0.0.1) +4 more potentially affected by CVE-2021-23372 via mongo-express (>=0.19.0, <=0.53.0)
mongo-express NPM version =0.19.0, =1.0.0, =0.1.1, =1.0.0, =1.5.0, =1.6.1 Source cves: CVE-2021-23372 Source advisory: OSV:GHSA-M2R3-8492-VX59...
GHSA-M2R3-8492-VX59 Denial of Service (DoS) in mongo-express
All versions of package mongo-express are vulnerable to Denial of Service DoS when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash...
53Kf 跨站脚本漏洞
Zhejiang Express Service 53Kf is an online customer service system from the Chinese company Zhejiang Express Service. A cross-site scripting vulnerability exists in 53KF, which is caused by the product's chat window not validating user input. The vulnerability can be exploited to cause client-sid...
Apple Pay Can be Abused to Make Contactless Payments From Locked iPhones
Cybersecurity researchers have disclosed an unpatched flaw in Apple Pay that attackers could abuse to make an unauthorized Visa payment with a locked iPhone by taking advantage of the Express Travel mode set up in the device's wallet. "An attacker only needs a stolen, powered on iPhone. The...
Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities (CVE-2020-13938, CVE-2021-30641)
Summary IBM Security SiteProtector System has addressed the following vulnerabilities in Apache HTTP Server. Vulnerability Details CVEID: CVE-2020-13938 DESCRIPTION: Apache HTTP Server is vulnerable to a denial of service, caused by the improper handling of insufficient privileges. A local attack...
Apple Pay with Visa Hacked to Make Payments via Unlocked iPhones
An attacker who steals a locked iPhone can use a stored Visa card to make contactless payments worth up to thousands of dollars without unlocking the phone, researchers are warning. The problem is due to unpatched vulnerabilities in both the Apple Pay and Visa systems, according to an academic te...
CVE-2021-36285
Dell BIOS contains an Improper Restriction of Excessive Authentication Attempts vulnerability. A local authenticated malicious administrator could exploit this vulnerability to bypass excessive NVMe password attempt mitigations in order to carry out a brute force attack...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
Cross site scripting
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
CVE-2021-41317: Improper Authentication
XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths...
XssHunter-Express 授权问题漏洞
XssHunter-Express is used to test and find blind XSS. XssHunter-Express suffers from an Authorization Problem vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...
PT-2021-23272
Name of the Vulnerable Software and Affected Versions XSS Hunter Express versions prior to 2021-09-17 Description The issue is related to the improper enforcement of authentication requirements for certain paths. This could potentially allow unauthorized access to sensitive areas of the...
Spoofing Bug Highlights Cybersecurity for Digital Vaccine Passports
Three weeks after an independent researcher found a critical bug in the Services Australia COVID-19 digital vaccine certificate that would allow an attacker to falsify someone’s vaccine status, it still hasn’t been fixed. Researcher Richard Nelson looked into the security behind a new digital...
GHSA-7F5C-RPF4-86P8 Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express rende...