Malicious 󠅮󠅰󠅭Package

Overview All versions of 1337qq-js contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes: - Environment variables - Running processes - /etc/hosts - uname -a - npmrc file Recommendation Remove t...

X (Formerly Twitter): Reflected XSS in twitterflightschool.com

While testing twitterflightschool.com, I came across the below endpoint: https://twitterflightschool.com/authentication/fbcallback?error=accessdenied&errorcode=200&errordescription= I noticed that it is possible to inject JS payload in "errordescription=" parameter and trigger XSS in...

AZL-44298 CVE-2019-20149 affecting package js-jquery for versions less than 3.5.0-4

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

CVE-2019-17527

dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=comjsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter...

Sql injection

dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=comjsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter...

CVE-2019-17527

dataForDepandantField in models/custormfields.php in the JS JOBS FREE extension before 1.2.7 for Joomla! allows SQL Injection via the index.php?option=comjsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter...

CVE-2019-17527

The CVE concerns the JS JOBS FREE Joomla! extension. Before version 1.2.7, the extension’s models/custormfields.php contains the dataForDepandantField function, which allows SQL Injection via the index.php?option=com_jsjobs&task=customfields.getfieldtitlebyfieldandfieldfo child parameter. Multipl...

Cross-Site Scripting

Overview Versions of serialize-to-js prior to 3.0.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications. Recommendation Upgrade to version 3.0.1 or later. References - GitHub advisory -...

serialize-to-js cross-site scripting vulnerability

serialize-to-js is a package that serializes objects to strings. A cross-site scripting vulnerability exists in serialize-to-js NPM versions prior to 3.0.1. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this...

CVE-2019-16772

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting XSS. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of...

Cross site scripting

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting XSS. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of...

CVE-2019-16772 regular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-js

The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting XSS. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of...

CVE-2019-16772

The CVE-2019-16772 entry concerns the npm package serialize-to-js, with versions before 3.0.1 vulnerable to XSS due to unsafe characters in serialized regular expressions. Node.js environments are not affected because RegExp.prototype.toString() escapes forward slashes, but non-Node.js environmen...

Cross-Site Scripting in serialize-to-js

Versions of serialize-to-js prior to 3.0.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications. Recommendation Upgrade to version 3.0.1 or later...

GHSA-3FJQ-93XJ-3F3F Cross-Site Scripting in serialize-to-js

Versions of serialize-to-js prior to 3.0.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications. Recommendation Upgrade to version 3.0.1 or later...

@achil/parcel-bundler (>=1.11.1, <=1.12.34), @acies/core (>=1.2.89, <=1.2.215) +133 more potentially affected by CVE-2019-10769 via safer-eval (>=1.2.3, <=1.3.6)

safer-eval NPM version =1.2.3, =1.11.1, =1.2.89, =0.1.0, =4.0.0, =4.1.0, =4.1.2, =0.9.2-pre.41, =2.0.2-pre.3, =1.0.0, =1.9.3-ext.1, =0.3.0, =1.12.3, =1.0.0, =0.0.1, =3.4.4 and more Source cves: CVE-2019-10769 Source advisory: SNYK:JS-SAFEREVAL-534901...

3nit-utils (>=0.30.0, <=1.0.2), @aller/theming (>=1.0.0, <=1.0.2) +25 more potentially affected by unknown CVE via devalue (2.0.0)

devalue NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on devalue and may be impacted: - 3nit-utils =0.30.0, =1.0.0, =1.2.1-next.3, =0.0.1, =0.1.1, =1.11.8, =4.1.1, =0.1.2, =0.1.1, =0.0.2-canary.2, =9.0.5-canary.0, =9.1.5-canary.9 and...

Cross site scripting

KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":"value":"' substring...

GHSA-89CH-HQF9-RGP3 Using JS libraries with known security vulnerabilities

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries Bootstrap, jquery, Knockout with known security vulnerabilities...

Using JS libraries with known security vulnerabilities

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries Bootstrap, jquery, Knockout with known security vulnerabilities...