5795 matches found
js-toml 安全漏洞
js-toml is a TOML parser for JavaScript by Sunny Personal Developer. A security vulnerability exists in versions of js-toml prior to 1.0.2, which stems from a prototype contamination vulnerability that could lead to modification of the global Object.prototype property...
CVE-2025-50592: Improper Neutralization of Input During Web Page Generation
Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player...
CVE-2025-50592
The seacms content management system, primarily used for video-on-demand resources, is vulnerable to a Cross Site Scripting (XSS) issue in versions prior to 13.2 . The vulnerability is located in the vid parameter within the path Upload/js/player/dmplayer/player. This flaw could allow an attacker...
NanoVault 安全漏洞
NanoVault is an open source wallet software using Nano cryptocurrency by Andrew Steele, an individual developer. A security vulnerability exists in NanoVault 1.2.1 and earlier versions, which stems from a cross-site scripting vulnerability in the function executeJavaScript in file/main.js...
CVE-2025-54803: Improperly Controlled Modification of Object Prototype Attributes
js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This is fixed...
GHSA-65FC-CR5F-V7R2 js-toml Prototype Pollution Vulnerability
A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. Impact The js-toml library is vulnerable to Prototype Pollution. When parsing a TOML string containing the specially...
js-toml Prototype Pollution Vulnerability
A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. Impact The js-toml library is vulnerable to Prototype Pollution. When parsing a TOML string containing the specially...
barrelly (>=1.0.0, <=1.2.0) potentially affected by CVE-2025-54803 via js-toml (1.0.0)
js-toml NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on js-toml and may be impacted: - barrelly =1.0.0, =1.2.0 Source cves: CVE-2025-54803 Source advisory: OSV:GHSA-65FC-CR5F-V7R2...
PT-2025-31886 · Js-Toml · Js-Toml
Name of the Vulnerable Software and Affected Versions: js-toml versions prior to 1.0.2 Description: A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. This can lead to seve...
CVE-2025-54789: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed i...
Malicious code in tensor-nft-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-6661 Malicious code in tensor-nft-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-6424 Malicious code in intercom-gtm-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-6416 Malicious code in ethers-js-core (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ethers-js-core (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-6345 Malicious code in vite-plugin-js-support (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 623ab60cdb0568726940f6f7f51b62cad9f69bd835cbf4e9a0fcbda0530a307c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in vite-plugin-js-support (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 623ab60cdb0568726940f6f7f51b62cad9f69bd835cbf4e9a0fcbda0530a307c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-4979
A cross-site scripting XSS vulnerability exists in Sitecore Experience Platform XP 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platfor...
zip
This is a robust ZIP decoder with defenses against various types of malicious archive signatures, including dangerous compression ratios, spec deviations, and ambiguous UTF-8 filenames. The decoder is implemented in JavaScript and is designed to be used in a Node.js environment. It provides a ran...
MAL-2025-6240 Malicious code in xp-anti-fraud-js-lib (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f4628140ad8ca2bfe8fde97530e932f9f26df49b3841157bc7f8aa50535e77f7 The OpenSSF Package Analysis project identified 'xp-anti-fraud-js-lib...