@braira/changelog (>=1.0.0, <=1.0.4), grunt-ivantage-svn-changelog (>=0.3.0, <=0.4.1) potentially affected by CVE-2022-25853 via semver-tags (>=0.1.5, <=0.4.10)

semver-tags NPM version =0.1.5, =1.0.0, =0.3.0, =0.4.1 Source cves: CVE-2022-25853 Source advisory: OSV:GHSA-8H3G-HCWP-6HXQ...

grunt-yellowlabtools (>=1.1.3, <=1.2.0), yellowlabtools (>=1.10.0, <=1.12.3) potentially affected by CVE-2022-25906 via is-http2 (>=1.0.4, <=1.1.0)

is-http2 NPM version =1.0.4, =1.1.3, =1.10.0, =1.12.3 Source cves: CVE-2022-25906 Source advisory: OSV:GHSA-2275-RPF5-XV8H...

@braira/changelog (>=1.0.0, <=1.0.4), grunt-ivantage-svn-changelog (>=0.3.0, <=0.4.1) potentially affected by CVE-2022-25853 via semver-tags (>=0.1.5, <=0.4.10)

semver-tags NPM version =0.1.5, =1.0.0, =0.3.0, =0.4.1 Source cves: CVE-2022-25853 Source advisory: SNYK:JS-SEMVERTAGS-3175612...

OESA-2022-2048 nodejs-grunt security update

Grunt is the JavaScript task runner. Why use a task runner? In one word: automation. The less work you have to do when performing repetitive tasks like minification, compilation, unit testing, linting, etc, the easier your job becomes. After you've configured it, a task runner can do most of that...

Prototype Pollution

grunt-karma is vulnerable to prototype pollution. The vulnerability is due to the exports functions in grunt-karma.js where an attacker cam injects properties into the existing JavaScript construct prototype...

GHSA-HCJ4-XF6X-63WJ Grunt-karma vulnerable to prototype pollution

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

Grunt-karma vulnerable to prototype pollution

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

AZL-45309 CVE-2022-37602 affecting package js-jquery 3.5.0-4

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

Code injection

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

grunt-karma 安全漏洞

grunt-karma is a grunt plugin for Karma by karma-runner individual developers. A security vulnerability exists in karma-runner grunt-karma version 4.0.1, which stems from a prototype contamination vulnerability via the key variable in grunt-karma.js...

CVE-2022-37602

Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...

CVE-2022-37602

Summary : CVE-2022-37602 is a prototype pollution vulnerability in the npm package grunt-karma 4.0.1 (karma-runner integration), reported across multiple sources. The issue arises via the key variable in grunt-karma.js, enabling an attacker to contaminate object prototypes. CVSSv3.1 base metrics ...

PT-2022-24023 · Unknown · Grunt-Karma +1

Name of the Vulnerable Software and Affected Versions: karma-runner grunt-karma version 4.0.1 Description: The issue is related to a prototype pollution vulnerability in the karma-runner grunt-karma. It occurs via the key variable in grunt-karma.js. Recommendations: For version 4.0.1, consider...

GHSA-56X4-J7P9-FCF9 Command Injection in moment-timezone

Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. if Alice uses tzdata pipeline to package moment-timezone on her own for example via grunt data:2014d, where 2014d stands for the version of the tzdata to be used from IANA's website, and Alice...

GHSA-V78C-4P63-2J6C Cleartext Transmission of Sensitive Information in moment-timezone

Impact if Alice uses grunt data or grunt release to prepare a custom-build, moment-timezone with the latest tzdata from IANA's website and Mallory intercepts the request to IANA's unencrypted ftp server, Mallory can serve data which might exploit further stages of the moment-timezone tzdata...

PT-2022-28198 · Unknown · Moment-Timezone

Name of the Vulnerable Software and Affected Versions: moment-timezone versions 0.1.0 through 0.5.34 Description: The issue concerns command injection vulnerabilities in moment-timezone. An attacker can execute arbitrary commands on the system running the grunt task with the same privileges as th...

Malicious code in grunt-contrib-ugliyf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dee610f58dcdea004a68d2bbb239c6ffdab3d08270390b335f4ad371d383f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...