@syncpoint/odrix (>=1.2.0, <=1.3.4), matrix-react-sdk (>=3.48.0-rc.1, <=3.55.0) +1 more potentially affected by CVE-2022-39236 via matrix-js-sdk (>=17.2.0, <=19.6.0-rc.1)

matrix-js-sdk NPM version =17.2.0, =1.2.0, =3.48.0-rc.1, =2.2.0, =3.1.0 Source cves: CVE-2022-39236 Source advisory: OSV:GHSA-HVV8-5V86-R45X...

GHSA-HVV8-5V86-R45X Improper beacon events in matrix-js-sdk can result in availability issues

Impact Improperly formed beacon events from MSC3488 can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data...

Improper beacon events in matrix-js-sdk can result in availability issues

Impact Improperly formed beacon events from MSC3488 can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data...

Denial Of Service (DoS)

matrix-js-sdk is vulnerable to denial of service attacks. The vulnerability exists in the senderKey parameter inmegolm.js due to improperly formed beacon events which allows an attacker to craft a malicious event and crash the system...

CVE-2022-39250

Removed by vendor...

Cross site scripting

ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting XSS. Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in...

CVE-2022-40912

ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting XSS. Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in...

CVE-2022-39236: Improper Input Validation

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Starting with version 17.1.0-rc.1, improperly formed beacon events can disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the...

CVE-2022-40912: Improper Neutralization of Input During Web Page Generation

ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting XSS. Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in...

CVE-2022-39249: Key Exchange without Entity Authentication

Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript. Prior to version 19.7.0, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be...

secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

GHSA-Q3F4-9H4P-VGR3 secp256k1-js implements ECDSA without required r and s validation, leading to signature forgery

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

CVE-2022-41340

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

Design/Logic Flaw

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

CVE-2022-41340

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

CVE-2022-41340

The CVE-2022-41340 issue concerns the secp256k1-js package for Node.js prior to version 1.1.0. The root cause is lack of required r and s validation in the ECDSA implementation, which enables signature forgery. Affected software: secp256k1-js before 1.1.0. The recommended remediation is to upgrad...

CVE-2022-41340

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

CVE-2022-41340

The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery...

secp256k1-js 数据伪造问题漏洞

secp256k1-js is a pure JS implementation of secp256k1 for signing, verifying, and recovering ECDSA by the individual developer Lio Liou lionello. A security vulnerability exists in versions of secp256k1-js prior to 1.1.0, which stems from the lack of r and s validation in the implementation of...

PT-2022-25818 · Unknown · Secp256K1-Js

Name of the Vulnerable Software and Affected Versions: secp256k1-js versions prior to 1.1.0 Description: The issue is related to the implementation of ECDSA in the secp256k1-js package, which lacks required r and s validation. This omission can lead to signature forgery. Recommendations: For...