PT-2024-27076 · Unknown · Js-Object-Resolver

Name of the Vulnerable Software and Affected Versions: js-object-resolver versions prior to 3.1.1 Description: The issue allows for Prototype Pollution via the setNestedProperty function of the Module. This can potentially lead to unintended behavior or security issues. Recommendations: For...

CVE-2024-36577: Improper Neutralization of Input During Web Page Generation

apphp js-object-resolver 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty...

CVE-2024-5994: Improper Neutralization of Input During Web Page Generation

The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom JS option in versions up to, and including, 9.0.38. This makes it possible for authenticated attackers that have been explicitly granted permissions by an administrator, with...

The vulnerability of the isPublic() function in the node-ip utility of the Node.js software platform allows a attacker to execute an SSRF attack.

The vulnerability of the isPublic function in the node-ip utility of the Node.js software platform is related to incorrect classification of IP addresses. Exploiting this vulnerability could allow a remote attacker to execute an SSRF attack...

CVE-2024-36233 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting XSS vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue typically...

CVE-2024-36221 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page...

Malicious code in exel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6083dc24b3cdb6bfd02f5426aa373f2425aab6e9508e12255fc1e08133809bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ozon-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6a05e800a141f7c456358b5d20b4e3cebc65f9d0229d0024fae5b1e51ed1e51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1597 Malicious code in exel-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6083dc24b3cdb6bfd02f5426aa373f2425aab6e9508e12255fc1e08133809bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Denial Of Service (DoS)

@grpc/grpc-js is vulnerable to Denial of Service DoS. The vulnerability is due to improper message size checks becauses messages that exceed the grpc.maxreceivemessagelength are buffered or decompressed in entirety before being discarded, which can result in DoS...

Important: firefox

Issue Overview: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. CVE-2024-4367 If the browser.privatebrowsing.autostart preference is...

PT-2024-35020 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.23 Description: The issue is related to Stored Cross-Site Scripting via the custom js parameter due to insufficient input sanitization and output...

@a11ywatch/core (>=0.8.13, <=0.8.15), @a11ywatch/mav (>=0.7.17, <=0.7.27) +91 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.9.0, <=1.9.14)

@grpc/grpc-js NPM version =1.9.0, =0.8.13, =0.7.17, =0.9.42, =3.1.3, =0.61.0, =1.61.0, =0.2.2, =0.1.1, =0.0.5, =0.0.6, =0.0.8, =0.0.11, =0.0.5, =1.0.1, =7.1.3 and more Source cves: CVE-2024-37168 Source advisory: OSV:GHSA-7V5V-9H63-CJ86...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +82 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.10.0, <=1.10.8)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =3.1.9, =0.78.0, =1.68.0, =8.5.1-alpha.4, =3.5.2, =17.8.3, =0.0.1-hw-fix-code-nightly-gha.29105, =0.1.5-hw-fix-code-nightly-gha.29105, =0.1.5-pd-ent-755-gha.29158 and more Source cves: CVE-2024-37168 Source advisory:...

GHSA-7V5V-9H63-CJ86 @grpc/grpc-js can allocate memory for incoming messages well above configured limits

Impact There are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded. 2. If an...

-temp-electron-manager-somiibo (0.0.200), 0xpass (>=0.0.2, <=0.0.8) +4332 more potentially affected by CVE-2024-37168 via @grpc/grpc-js (>=1.0.0, <=1.8.21)

@grpc/grpc-js NPM version =1.0.0, =0.0.2, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.0.0, =0.3.30, =0.3.30, =0.4.16 and more Source cves: CVE-2024-37168 Source advisory: OSV:GHSA-7V5V-9H63-CJ86...

CVE-2024-37168 @grpc/grpc-js can allocate memory for incoming messages well above configured limits

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: If an...

CVE-2024-37168

CVE-2024-37168 affects @grpc/grpc-js (pure JavaScript implementation of gRPC). Before the fixes, two code paths could buffer or decompress messages that exceed grpc.max_receive_message_length, potentially causing memory allocation in excess of the limit. This could occur when a message arrives la...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...

CVE-2024-37168: Memory Allocation with Excessive Size Value

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: If an...