CVE-2021-21422 XSS Vulnerability in mongo-express

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, howev...

CVE-2021-21422: Improper Neutralization of Input During Web Page Generation

mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/mongo-express/mongo-express/issues/577, when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, howev...

PT-2021-14495

Name of the Vulnerable Software and Affected Versions mongo-express versions prior to v1.0.0-alpha.4 Description The issue concerns a web-based MongoDB admin interface, where two types of XSS attacks are possible. When the content of a cell exceeds the supported size, clicking on a row will displ...

mongo-express 跨站脚本漏洞

mongo-express is a lightweight, web-based management interface for interactively managing MongoDB databases. A security vulnerability exists in mongo-express that stems from the ability of an unauthorized user to send large amounts of data...

PT-2021-7443

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center affected versions not specified Cisco Unified Contact Center Express affected versions not specified Description A vulnerability in the web-based management interface could allow an unauthenticated, remote...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Squirrelly

CVE-2021-32819 CVE-2021-32819 : SquirrellyJS mixes pure templa...

SUSE: Security Advisory (SUSE-SU-2018:3927-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview calipso is a Calipso is a simple NodeJS content management system based on Express, Connect & Mongoose. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. It is possible for a malicious module to overwrite files on an arbitrary file...

American Express Fined Over Millions of Spam Messages

American Express Services Europe has been fined £90,000 $127,377 by a U.K. regulator, which found the company illegally blasted out 4 million marketing emails to customers who had opted out of receiving them. Critics said the fine, which is nominal for the multi-national financial brand, isn’t...

Pega Infinity patches authentication vulnerability

Security researchers came across a Pega Infinity vulnerability through participation in Apple’s bug bounty program, after focusing on vendors that supplied technology to Apple. By using Burp Suite—an integrated platform for performing security testing of web applications—the security researchers...

@deg-skeletor/plugin-express (>=1.4.0, <=1.4.8), @magento/create-pwa (>=1.0.0-alpha.1, <=3.0.0-alpha.4) +5 more potentially affected by CVE-2020-8186 via devcert (>=1.0.0, <=1.1.1)

devcert NPM version =1.0.0, =1.4.0, =1.0.0-alpha.1, =2.0.0-rc.15, =2.0.0-rc.3, =0.0.99, =1.0.0, =1.0.0, =1.0.5 Source cves: CVE-2020-8186 Source advisory: OSV:GHSA-4228-7QVX-F4RQ...

Insecure template handling in express-hbs

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...

@igames/ghost (>=3.41.6, <=4.0.0-alpha.2), @loftysoul/soul (>=3.0.3-1-soul, <=3.0.16-soul) +8 more potentially affected by CVE-2021-32817 via express-hbs (>=2.0.2, <=2.3.5)

express-hbs NPM version =2.0.2, =3.41.6, =3.0.3-1-soul, =3.0.7, =4.0.4, =1.26.1, =3.17.1, =3.2.1, =0.0.4, =0.1.1-alpha.0 - sign-alex 1.0.1 Source cves: CVE-2021-32817 Source advisory: OSV:GHSA-RWXP-HWWF-653V...

GHSA-RWXP-HWWF-653V Insecure template handling in express-hbs

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...

Insecure template handling in haml-coffee

haml-coffee is a JavaScript templating solution. haml-coffee mixes pure template data with engine configuration options through the Express render API. More specifically, haml-coffee supports overriding a series of HTML helper functions through its configuration options. A vulnerable application...

Information Disclosure

express-hbs is vulnerable to information disclosure. The layout parameter allows a remote attacker to access and retrieve arbitrary local files that are accessible by the process worker...

Information Disclosure

express-handlebars is vulnerable to information disclosure. The vulnerability exists due to a the mixing of untrusted data with the express-handlebars options passed to the template data...

CVE-2021-32820

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...

CVE-2021-32817

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability...

CVE-2021-32820

Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential...