CVE-2021-2411

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: JS module. Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successfu...

Oracle MySQL Cluster Denial of Service Vulnerability (CNVD-2021-57180)

MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database. A security vulnerability exists in the Cluster: JS module component in Oracle MySQL Cluster 8.0.25 and earlier. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2021-2411

CVE-2021-2411 affects Oracle MySQL Cluster (Cluster: JS module) with affected versions 8.0.25 and earlier. The vulnerability is exploitable by an unauthenticated attacker over network via multiple protocols, leading to partial denial of service of MySQL Cluster. The connected sources confirm the ...

Oracle MySQL Cluster 输入验证错误漏洞

MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database. A security vulnerability exists in the Cluster: JS module component in Oracle MySQL Cluster 8.0.25 and earlier. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2021-24452 W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting XSS issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript...

U.S. Dept Of Defense: Reflected XSS on [█████████]

Summary: Hi security team members, I found a reflected XSS on the URL Impact 1. An attacker can steal the victim's cookies. 2. An attacker can execute JS code. System Hosts █████ Affected Products and Versions CVE Numbers Steps to Reproduce 1. Navigate to this link:-...

ccxvii mujs 缓冲区错误漏洞

ccxvii mujs is an open source embeddable C interpreter. ccxvii mujs suffers from a buffer error vulnerability that originates from a buffer overflow vulnerability in the jsGmarkobject function in jsgc.c of mujs. Exploitation of this vulnerability allows remote attackers to cause a denial of servi...

ALPINE-CVE-2021-22918

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to...

CVE-2021-30121

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp A valid sessionId is required but can be easily obtained via CVE-2021-30118...

js-stellar-sdk authorization issue vulnerability

js-stellar-sdk is an application. A Javascript library for communicating with the Stellar Horizon server. A security vulnerability exists in Js-stellar-sdk versions prior to 8.2.3, which stems from the program's "Utils.readChallengeTx" function not verifying that the server has signed the...

CVE-2021-32738

js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the...

XSS Injection in Media Collection Title was possible

Impact A logged in admin user was possible to add a script injection XSS in the collection title which was executed. Workarounds Manual patching the js files. For more information If you have any questions or comments about this advisory:' - Email us at [email protected]...

GHSA-GM2X-6475-G9R8 XSS Injection in Media Collection Title was possible

Impact A logged in admin user was possible to add a script injection XSS in the collection title which was executed. Workarounds Manual patching the js files. For more information If you have any questions or comments about this advisory:' - Email us at [email protected]...

CVE-2021-32738

CVE-2021-32738 affects the js-stellar-sdk library used to interact with Stellar Horizon. The vulnerability lies in Utils.readChallengeTx, which, before version 8.2.3, did not verify that the server signature was present on the challenge transaction; however, signature verification via Utils.verif...

CVE-2021-32738 Utils.readChallengeTx does not verify the server account signature

js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the...

UBUNTU-CVE-2021-22918

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to...

Unspecified vulnerability in 101 applications

101 is an application program . Provides a JS util library. A security vulnerability exists in 101 versions 1.0.0 through 1.6.3, which can be exploited by an attacker to cause a denial of service and potentially lead to remote code execution...

Unspecified vulnerability in 101 applications (CNVD-2021-47376)

101 is an application program . Provides a JS util library. A security vulnerability exists in 101 versions 1.0.0 through 1.6.3, which can be exploited by an attacker to cause a denial of service and potentially lead to remote code execution...

Medium: python-lxml

Issue Overview: A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing different behaviors between the sanitizer and the user's page. This flaw allows a remote attacker to run arbitrary HTML/JS code. The...

Cross-site Scripting (XSS) - Stored in livehelperchat/fbmessenger

✍️ Description The Facebook notifications of livehelperchat fbmessenger extension can be modified listing new notifications. However, the template is used incorrectly resulting in a CSTI injection which leads to stored XSS. 🕵️‍♂️ Proof of Concept Install the livechat Install fbmessenger extension...