5821 matches found
CVE-2024-45607 whatsapp-api-js fails to validate message's signature
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...
CVE-2024-45607
CVE-2024-45607 affects whatsapp-api-js, a TypeScript server-agnostic WhatsApp Official API framework. The issue is improper validation of request signatures in WhatsAppAPI.verifyRequestSignature, allowing incorrect access control by manipulating the signature verification process and potentially ...
CBL Mariner 2.0 Security Update: js-jquery (CVE-2019-20149)
The version of js-jquery installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-20149 advisory. - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attribute...
CVE-2024-45607: Improper Verification of Cryptographic Signature
whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...
Malicious code in passports-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f07e6135ed2ddf89c87508abbc5a583e3ae22a8ae354dfd915c99471e01dbbd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-8868 Malicious code in passports-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f07e6135ed2ddf89c87508abbc5a583e3ae22a8ae354dfd915c99471e01dbbd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in bcrypts-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 119f108e696a505c0b232d8ee8e4919de05b9f92725dcc535747aea9290433ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-8862 Malicious code in bcrypts-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 119f108e696a505c0b232d8ee8e4919de05b9f92725dcc535747aea9290433ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in cryptograph-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344b01183d31f7bfbadedba12b2bfe4e733ea76938ea8976787f6c400b39f5a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-8861 Malicious code in cryptograph-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344b01183d31f7bfbadedba12b2bfe4e733ea76938ea8976787f6c400b39f5a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-78VG-7V27-HJ67 auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped
Summary Unescaped entity property enables Javascript injection. Details I think this is possible because %sourcelabel% in twig macro is not escaped. Therefore script tags can be inserted and are executed. PoC - clone example project https://github.com/DamienHarper/auditor-bundle-demo - create...
CVE-2024-43412 Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS
Xibo is an open source digital signage platform with a web content management system CMS. Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute arbitrary JavaScript via the file preview function. Users can upload HTML/CSS/JS files into the Xib...
CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4
CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4. A patched version of the package is available...
LimeSurvey 安全漏洞
LimeSurvey PHPSurveyor is a set of open source online questionnaire survey program from LimeSurvey team, which supports survey program development, questionnaire publishing and data collection. A security vulnerability exists in LimeSurvey version v6.6.2 and earlier versions, which stems from an...
PT-2024-30196 · Unknown · Limesurvey
Name of the Vulnerable Software and Affected Versions: LimeSurvey versions 6.6.2 and earlier Description: An issue in the js localize.php function allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js localize.php function. This issue enables...
ua-parser-js npm module ReDenial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ua-parser-js npm module ReDoS', 'Description' = %q This module exploits a Regular Expression Denial of Service vulnerability in the npm module...
Simple College Website 1.0 SQL Injection / Code Execution
============================================================================================================================================= | Title : Simple College Website 1.0 WYSIWYG Settings Management Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla...
CVE-2024-41444: Improper Neutralization of Special Elements used in an SQL Command
SeaCMS v12.9 has a SQL injection vulnerability in the key parameter of /js/player/dmplayer/dmku/index.php?ac=so...
PT-2024-29404
Name of the Vulnerable Software and Affected Versions SeaCMS versions 11.3 through 12.9 Description The issue is a SQL injection vulnerability in the key parameter of the "/js/player/dmplayer/dmku/index.php?ac=so" endpoint. This vulnerability can be exploited to inject malicious SQL code. Users a...
