Information Disclosure

auth0.js is vulnerable to information disclosure. Error objects are returned by the library containing confidential information such as the original request of the user or the plaintext password entered by the user...

Sandbox Breakout / Arbitrary Code Execution

Overview All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. Evaluating the payload function var ex = new Erro...