PT-2021-19951

Name of the Vulnerable Software and Affected Versions haml-coffee versions prior to 1.14.1 Description haml-coffee is a JavaScript templating solution that mixes pure template data with engine configuration options through the Express render API. It supports overriding a series of HTML helper...

Sifchain: Path Transversal inside saveContracts.js

Reference: https://portswigger.net/web-security/file-path-traversal Directory traversal also known as file path traversal is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data,...

Cross-Site Scripting (XSS)

express-cart is vulnerable to cross-site scripting XSS. An attacker with administrative privileges is able to inject and execute arbitrary Javascript in a victim's browser...

CVE-2021-32573

The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website...

CVE-2021-32573

The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website...

Cross site scripting

DISPUTED The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website."...

CVE-2021-32573: Improper Neutralization of Input During Web Page Generation

The express-cart package through 1.1.10 for Node.js allows Reflected XSS for an admin via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website...

PT-2021-19788 · Unknown · Express-Cart

Name of the Vulnerable Software and Affected Versions: express-cart versions 1.1.10 and earlier Description: The issue allows Reflected XSS for an admin via a user input field for product options. It is noted that exploitation would rely on an admin hacking their own website. Recommendations: For...

express-cart 跨站脚本漏洞

express-cart is a shopping cart module for use in Node.js. A cross-site scripting vulnerability exists in express-cart version 1.1.10. An attacker can exploit this vulnerability to obtain sensitive information...

GHSA-CF2X-RQC8-GRFQ Regular expression deinal of service in express-validators

All versions of package express-validators are vulnerable to Regular Expression Denial of Service ReDoS when validating specifically-crafted invalid urls...

@myticketing/common (>=1.0.3, <=1.0.5), @pavtickets/common (1.0.2) potentially affected by CVE-2020-7767 via express-validators (1.0.4)

express-validators NPM version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on express-validators and may be impacted: - @myticketing/common =1.0.3, =1.0.5 - @pavtickets/common 1.0.2 Source cves: CVE-2020-7767 Source advisory:...

Logic Flaw Vulnerability in Super Star Learning Express Application System Platform

Chaostar is the abbreviation of Beijing Chaostar Company full name: Beijing Century Chaostar Information Technology Development Co., Ltd. Founded in 1993, Chaostar is one of the early companies in China engaged in digitization of paper materials as well as production of electronic publications. A...

CVE-2021-26073

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

CVE-2021-26073

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

Authentication flaw

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

CVE-2021-26073

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

CVE-2021-26073

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

CVE-2021-26073

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...

CVE-2021-26073

CVE-2021-26073 affects Atlassian Connect Express (ACE) in Node.js. ACE versions 3.0.2 through 6.5.0 (before 6.6.0) erroneously accept context JWTs on lifecycle endpoints (e.g., installation) where only server-to-server JWTs should be accepted, enabling an attacker to send authenticated re-install...

CVE-2021-26073: Improper Authentication

Broken Authentication in Atlassian Connect Express ACE from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or...