5503 matches found
AZL-44673 CVE-2020-36048 affecting package js-jquery 3.5.0-4
Engine.IO before 4.0.0 allows attackers to cause a denial of service resource consumption via a POST request to the long polling transport...
Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2021-1035)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
lxml vulnerable to Cross-site Scripting
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...
CVE-2020-24901
The default installation of Krpano Panorama Viewer version =1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugintest.url...
Cross site scripting
The default installation of Krpano Panorama Viewer version =1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugintest.url...
CVE-2020-24901
The default installation of Krpano Panorama Viewer version =1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugintest.url...
CVE-2020-24901
The default installation of Krpano Panorama Viewer version =1.20.8 is vulnerable to Reflected XSS due to insecure remote js load in file viewer/krpano.html, parameter plugintest.url...
ALPINE-CVE-2020-8265
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 are vulnerable to a use-after-free bug in its TLS implementation. When writing to a TLS enabled socket, node::StreamBase::Write calls node::TLSWrap::DoWrite with a freshly allocated WriteWrap object as first argument. If the DoWrite method...
OSV-2021-16 Stack-buffer-overflow in JS::Heap::gather_conservative_roots
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=29266 Crash type: Stack-buffer-overflow READ 8 Crash state: JS::Heap::gatherconservativeroots JS::Heap::gatherroots JS::Heap::collectgarbage...
Mail.ru: Eval-based XSS in Game JS API (mailru.core.js) via cross-origin postMessage()
mailru.core.js as used by GMR/store.my.games application was vulnerable to XSS via PostMessage handler...
EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-1016)
According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different...
EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-1035)
According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different...
AZL-44940 CVE-2020-28282 affecting package js-jquery 3.5.0-4
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution...
@bartificer/human-join (>=1.0.0, <=1.0.1), @frdl/custom-require (>=0.0.0, <=0.0.12) +43 more potentially affected by unknown CVE via node-ini (1.0.0)
node-ini NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on node-ini and may be impacted: - @bartificer/human-join =1.0.0, =0.0.0, =5.0.5, =0.0.3, =1.0.1, =1.1.0, =0.0.0, =0.1.0, =0.0.0, =1.1.1, =0.0.1, =0.0.2, =0.0.3 - chowder 0.0.1 and...
CVE-2020-26286
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that...
h1-ctf: Hacky Holidays Writeup
On December 12th, 2020, the CTF became live and the scope that we are allowed to attack was In Scope Domain - hackyholidays.h1ctf.com Our main motive was to infiltrate his network and take him down. The challenges appeared one by one till 24th of December. Here we will be going through all the...
h1-ctf: ctf walkthrough
Hi, finally managed to solve all challenges, this was my first h1ctf, some challenges were pretty nice, some others had some frustrating guessing parts, but overall it was fun. Here goes day1 to day12 walkthroughs: Day 1 we have only one asset in scope hackyholidays.h1ctf.com the main page at...
Regular Expression Denial Of Service (ReDoS)
ua-parser-js is vulnerable to regular expression denial of service ReDoS. The vulnerability exists through overly greedy regular expressions when parsing the browsers' user agent strings...