CVE-2020-14114: Undefined Security Weakness

information leakage vulnerability exists in the Xiaomi SmartHome APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information...

CVE-2020-14126: Undefined Security Weakness

Information leakage vulnerability exists in the Mi Sound APP. This vulnerability is caused by illegal calls of some sensitive JS interfaces, which can be exploited by attackers to leak sensitive information...

nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

@intlgadmin/skywalking-nodejs-prisma-plugin (1.0.0), logtube (>=2.3.0, <=2.4.0) +3 more potentially affected by CVE-2022-36127 via skywalking-backend-js (>=0.3.0, <=0.4.1)

skywalking-backend-js NPM version =0.3.0, =2.3.0, =1.2.144-2, =1.0.0, =1.0.4 Source cves: CVE-2022-36127 Source advisory: OSV:GHSA-8GPG-466C-5CPJ...

CVE-2022-30624

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password...

Code injection

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password...

CVE-2022-30624 Chcnav - P5E GNSS Authentication bypass admin password reset

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password...

CVE-2022-30624

CVE-2022-30624 affects Chcnav P5E GNSS. Browsing the admin.html page allows resetting the admin password, and the capability is also present in the JavaScript code for the password. This vulnerability is documented across multiple sources (NVD, CVE List, CNNVD, PRION/PRIO pages, ENISA EUVD) indic...

Malicious code in discord.js-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62488af56327cd0a22202bb93f65eff0b4070ab64d1c9a6197f8030c66504bf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora: Security Advisory for golang-github-tdewolff-minify (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-30622 Chcnav - P5E GNSS Information disclosure

Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path access: http://api/sysusernamepasswd.cmd - The server loads the request clearly by default. Disclosure of hard-coded credit information within...

[SECURITY] Fedora 35 Update: golang-github-tdewolff-minify-2.11.10-3.fc35

Minify is a minifier package written in Go. It provides HTML5, CSS3, JS, JSON, SVG and XML minifiers and an interface to implement any other minifier. Minification is the process of removing bytes from a file such as whitespace without changing its output and therefore shrinking its size and...

AZL-44553 CVE-2022-25858 affecting package js-jquery 3.5.0-4

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service ReDoS due to insecure usage of regular expressions...

OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager Relates to - https://github.com/artf/grapesjs/issues/4411 Patch Update GrapeJS dependency to =v0.19.5...

DEBIAN-CVE-2022-32214

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling HRS...

UBUNTU-CVE-2022-32215

The llhttp parser v14.20.1, v16.17.1 and v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling HRS...

UBUNTU-CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

UBUNTU-CVE-2022-32212

A OS Command Injection vulnerability exists in Node.js versions 14.20.0, 16.20.0, 18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before making DBS requests allowing rebinding attacks...

Malicious code in ugentec-framework-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a91b6a72d36e1f86952649dd1acf051dd8bc358d059c4ebe50b229b77170ece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the Node.js module and the control tools of App Connect Enterprise Certified Container allows a hacker to compromise protected information.

The vulnerability of the Node.js module related to the App Connect Enterprise Certified Container management tool is linked to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to compromise protected information...