nodejs: Node.js Worker Thread Exposure via Diagnostics Channel

A flaw was found in the Node.js diagnosticschannel. This vulnerability allows an attacker to reinstate and misuse worker constructors, potentially bypassing the Permission Model via hooking into events when a worker thread is created...

PT-2025-7066 · Node.Js +1 · Node.Js +1

Name of the Vulnerable Software and Affected Versions: parse-duraton versions prior to 2.1.3 Description: The issue is related to an event loop delay due to the CPU-bound operation of resolving the provided string, which can range from 0.5ms to 50ms per operation, depending on the size of the inp...

CVE-2025-24042

Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability...

CVE-2025-24042

Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability...

CVE-2025-24042 Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

...

CVE-2025-24042

CVE-2025-24042 : The issue is an Elevation of Privilege in the Visual Studio Code JS Debug Extension. Public sources describe two related weaknesses in VS Code components: (1) a vulnerability enabling privilege escalation via a crafted node module or binary injection in the JS Debug/remote server...

CVE-2025-24042 Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability

...

CVE-2025-24042: Improper Access Control

Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability...

vscode -- multiple vulnerabilities

VSCode developers report: The update addresses these issues, including a fix for a security vulnerability. Scope nodemodule binary resolution in js-debug Elevation of Privilege Vulnerability with VS Code server for web UI...

Prototype Pollution

@zag-js/core is vulnerable to prototype pollution. The vulnerability is due to improper handling of crafted payloads in the lib.deepMerge function, allowing attackers to cause a Denial of Service DoS...

Azure Linux 3.0 Security Update: js-jquery (CVE-2019-20149)

The version of js-jquery installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-20149 advisory. - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attribute...

CVE-2025-22206

A SQL injection vulnerability in the JS Jobs plugin versions 1.1.5-1.4.2 for Joomla allows authenticated attackers administrator to execute arbitrary SQL commands via the 'fieldfor' parameter in the GDPR Field feature...

CVE-2024-57079

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-13607

The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.8.8 via the 'exportusereraserequest' due to missing validation on a user controlled key. This makes it possible for authenticat...

@agniflow-ui/panda-preset (0.0.4), @agniflow-ui/react (>=0.0.1, <=0.0.4) +345 more potentially affected by CVE-2024-57079 via @zag-js/core (>=0.0.0-dev-20220406144843, <=0.82.1)

@zag-js/core NPM version =0.0.0-dev-20220406144843, =0.0.1, =0.0.1, =0.0.3-02402d7.0, =0.0.28-86b217d.0, =0.1.0, =0.0.0-rc-20221106094212, =0.0.0-rc-20221106094212, =0.1.0, =0.0.0-rc-20221106094212, =0.0.17, =0.0.2, =0.0.10 - @atlrdsgn/kit 0.3.7 - @beae-ui/accordion 1.0.0 - @beae-ui/pin-input 1.0...

@zag-js/core prototype pollution

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2022-47151

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

CVE-2024-57079

A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2022-46838

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...

CVE-2022-46839

Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.7.1...