ECDH Private Key Disclosure

ecdh is vulnerable to ECDH Private Key Disclosure. The vulnerability exists because the deriveSharedSecret function in index.js does not properly check if a point is on the curve, allowing an attacker to retrieve the derived shared secret...

CVE-2023-24251

WangEditor v5 was discovered to contain a cross-site scripting XSS vulnerability via the component /dist/index.js...

CVE-2023-24251

WangEditor v5 was discovered to contain a cross-site scripting XSS vulnerability via the component /dist/index.js...

CVE-2023-24251

WangEditor v5 was discovered to contain a cross-site scripting XSS vulnerability via the component /dist/index.js...

Denial Of Service (DoS)

fastify/multipart is vulnerable to Denial Of Service DoS. The vulnerability exists in the fastifyMultipart function in index.js due to accepting unlimited number of file parts which can cause an application crash...

SUSE CVE-2021-23362

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity...

SUSE CVE-2021-44906

Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95...

Path Traversal

glance is vulnerable to Path Traversal. The vulnerability exists because the library does not properly sanitize relative paths in index.js, allowing an attacker to read files outside the public root directory by providing malicious relative paths...

Regular Expression Denial Of Service (ReDoS)

sideway/formula is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in index.js due to regular expression complexity which allows attacker to provide crafted strings to the formula's parser that might lead to polynomial execution time causing an application crash...

Information Disclosure

@tinacms/app is vulnerable to Information Disclosure. The vulnerability exists because the viteBuild function in index.ts exposes environment variables to index.js, allowing an attacker to use a read only token to gain access to sensitive information...

CVE-2023-25164

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...

CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...

TinaCMS 日志信息泄露漏洞

TinaCMS is an open source headless CMS for Markdown, MDX and JSON. A log information disclosure vulnerability exists in TinaCMS versions prior to 1.0.9, which stems from sensitive values stored in the process.env variable being added in plaintext to the index.js file...

Command Injection

is-http2 is vulnerable to Command Injection. The vulnerability exists in the Promise function of index.js due to missing input sanitization which allows an attacker to inject and execute arbitrary commands into the system...

is-url Inefficient Regular Expression Complexity vulnerability

A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is an unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2....

CVE-2018-25079 Segmentio is-url index.js redos

A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version...

PT-2023-10820 · Segmentio · Is-Url

Name of the Vulnerable Software and Affected Versions: Segmentio is-url versions up to 1.2.2 Description: A vulnerability was found in the file index.js, leading to inefficient regular expression complexity. The attack may be launched remotely. Recommendations: For versions up to 1.2.2, upgrade t...

is-url 安全漏洞

is-url is a library for detecting whether a string is a URL. A security vulnerability exists in Segmentio is-url versions prior to 1.2.3, which stems from a problem with an unknown function in the file index.js that causes inefficient regular expression complexity...

Directory Traversal

servst is vulnerable to Directory Traversal. The vulnerability is due to improper path sanitization in index.js which can lead to an attacher accessing files outside the intended directory...

Command Injection

nemo-appium is vulnerable to Command Injection. The vulnerability exists due to improper input sanitization in the module.exports.setup function of index.js, allowing an attacker to inject and execute malicious commands. To successfully exploit this vulnerability, appium-running 0.1.3 must be...