@ahm-monash/public-test (1.0.0), @alotool/bl-pack (0.0.1) +156 more potentially affected by CVE-2022-25927 via ua-parser-js (>=0.8.1, <=1.0.32)

ua-parser-js NPM version =0.8.1, =1.2.398, =1.3.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.25.0-alpha.0, =0.25.0-beta.0, =0.25.0-beta.0, =0.25.0-beta.0, =0.25.0-beta.0, =0.25.0-beta.0, =0.26.0 and more Source cves: CVE-2022-25927 Source advisory: OSV:GHSA-FHG7-M89Q-25R3...

GHSA-FHG7-M89Q-25R3 ReDoS Vulnerability in ua-parser-js version

Description: A regular expression denial of service ReDoS vulnerability has been discovered in ua-parser-js. Impact: This vulnerability bypass the library's MAXLENGTH input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to g...

PT-2023-12838 · Unknown +1 · Ua-Parser-Js +1

Name of the Vulnerable Software and Affected Versions: ua-parser-js versions 0.7.30 through 0.7.32 ua-parser-js versions 0.8.1 through 1.0.32 Description: A regular expression denial of service ReDoS issue has been discovered in ua-parser-js, allowing an attacker to craft a long user-agent string...

@ahm-monash/public-test (1.0.0), @alotool/bl-pack (0.0.1) +156 more potentially affected by CVE-2022-25927 via ua-parser-js (>=0.8.1, <=1.0.32)

ua-parser-js NPM version =0.8.1, =1.2.398, =1.3.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.25.0-alpha.0, =0.25.0-beta.0, =0.25.0-beta.0, =0.25.0-beta.0, =0.25.0-beta.0, =0.25.0-beta.0, =0.26.0 and more Source cves: CVE-2022-25927 Source advisory: SNYK:JS-UAPARSERJS-3244450...

@alfresco/adf-testing (6.0.0-A.2-8258), @core-ui-kit/button (1.1.8) +49 more potentially affected by CVE-2022-25927 via ua-parser-js (>=0.7.30, <=0.7.32)

ua-parser-js NPM version =0.7.30, =0.1.0, =0.1.5, =0.3.367, =3.34.0, =1.106.0, =1.106.0, =7.5.0 and more Source cves: CVE-2022-25927 Source advisory: SNYK:JS-UAPARSERJS-3244450...

WordPress Amazon JS Plugin <= 0.10 is vulnerable to Cross Site Scripting (XSS)

Software Amazon JS Type Plugin Vulnerable versions = 0.10 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0075 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID c37014599a16 Credits István Márton Required...

Amazon JS <= 0.10 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC amazonjs asin='XSS' imgsize='"...

CVE-2023-24027: Improper Neutralization of Input During Web Page Generation

In MISP 2.4.167, app/webroot/js/actiontable.js allows XSS via a network history name...

CVE-2023-24026: Improper Neutralization of Input During Web Page Generation

In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload...

CVE-2023-22734

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. As a result operators may have inconsistencies in their newsletter systems. This...

CVE-2023-22733

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issu...

CVE-2023-22731

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment without the Sandbox extension, it is possible to refer to PHP functions in twig filters like map, filter, sort. This allows a template to call any global PHP function and thus execute arbitra...

Design/Logic Flaw

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions It was possible to put the same line item multiple times in the cart using the AP. The Cart Validators checked the line item's individuality and the user was able to bypass quantity limits in...

Design/Logic Flaw

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In a Twig environment without the Sandbox extension, it is possible to refer to PHP functions in twig filters like map, filter, sort. This allows a template to call any global PHP function and thus execute arbitra...

Design/Logic Flaw

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administratio...

Code injection

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issu...

CVE-2023-22733

CVE-2023-22733 affects Shopware’s log module in affected Shopware versions (notably 6.1, 6.2, 6.3, and up to 6.4.18.1). The vulnerability is an information disclosure risk where the log output may contain sensitive data, including password reset emails, if an attacker can access local system logs...

CVE-2023-22733 Improper Output Neutralization in Log Module in shopware

Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issu...

CVE-2023-22732 Insufficient Session Expiration in Administration in shopware

Shopware is an open source commerce platform based on Symfony Framework and Vue js. The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. In version 6.4.18.1 an automatic logout into the Administratio...

CVE-2023-22732

Shopware administration session expiration was set to one week, enabling reuse of a stolen session cookie. The issue is documented across multiple sources (CVE-2023-22732) and is mitigated by updating to version 6.4.18.1, which adds automatic logout after inactivity. The vulnerability affects the...