Code Injection in js-yaml

Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load function may execute arbitrary code injected through a malicious YAML file. Objects that have toString as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code...

PT-2019-20028

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 3.13.1 Description The issue allows for code injection through malicious YAML files. The load function may execute arbitrary code when it encounters objects with toString as a key and JavaScript code as a value, used ...

Kaspersky antivirus JS-formatted file handler Code Execution

The vulnerability of JS-formatted file handler components in Kaspersky antivirus tools is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code with system privileges...

CVE-2019-2045

In JSCallTyper of typer.cc, there is an out of bounds write due to an incorrect bounds check. This could lead to remote code execution in the proxy auto-config with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0...

CVE-2019-11814

An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot...

CVE-2019-11814: Improper Neutralization of Input During Web Page Generation

An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot...

chakra: Stack-use-after-return in Js::NarrowStringToWide

Detailed report: https://oss-fuzz.com/testcase?key=5668803167387648 Project: chakra Fuzzer: jsfuzzer Job Type: asanchakra Platform Id: linux Crash Type: Stack-use-after-return READ Crash Address: 0x7f9fb8b97920 Crash State: Js::NarrowStringToWide Js::WabtInterface::EntryConvertWast2Wasm...

osTicket 1.11 - Cross-Site Scripting / Local File Inclusion Vulnerabilities

Exploit for php platform in category web applications Exploit Title: osTicket v1.11 - Cross-Site Scripting to Local File Inclusion Exploit Author: Özkan Mustafa Akkuş AkkuS @ehakkus Contact: https://pentest.com.tr Vendor Homepage: https://osticket.com Software Link:...

CVE-2017-11429

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

CVE-2017-11429

CVE-2017-11429 affects Clever saml2-js (versions 2.0 and earlier). The issue arises from incorrect handling of XML DOM traversal and canonicalization APIs, allowing a remote attacker to modify SAML content without invalidating the cryptographic signature, potentially bypassing authentication to S...

CVE-2017-11429

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

CVE-2017-11429 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

CVE-2017-11429: Improper Authentication

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

PT-2019-7880

Name of the Vulnerable Software and Affected Versions saml2-js versions prior to 1.12.4 saml2-js versions prior to 2.0.2 Description The issue arises from the incorrect utilization of XML DOM traversal and canonicalization APIs, allowing an attacker to manipulate SAML data without invalidating it...

Arbitrary Code Execution

js-yaml is vulnerable to arbitrary code execution. The vulnerability exists through the usage of unsafe load function, which allows attackers to inject arbitrary code via a malicious YAML file using objects that have toString as key, JavaScript code as value and are used as explicit mapping keys...

Code Injection

Overview Versions of js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load function may execute arbitrary code injected through a malicious YAML file. Objects that have toString as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the...

Starbucks: Reflected XSS in https://www.starbucks.com/account/create/redeem/MCP131XSR via xtl_amount, xtl_coupon_code, xtl_amount_type parameters

HI, Summary: Reflected XSS Description: the parameters are complementary to each other Platforms Affected: my browser firefox 52.7.3 Steps To Reproduce: 1. go to https://www.starbucks.com/account/create/redeem/MCP131XSR?xtlcouponcode=1&xtlcouponcode=81431&xtlamount=0.0&xtlamounttype=DOLLARVALUE 1...

In-Depth Analysis of JS Sniffers Uncovers New Families of Credit Card-Skimming Code

In a world that's growing increasingly digital, Magecart attacks have emerged as a key cybersecurity threat to e-commerce sites. Magecart, which is in the news a lot lately, is an umbrella term given to 12 different cyber criminal groups that are specialized in secretly implanting a special piece...

Google Chrome 72.0.3626.81 - V8TrustedTypePolicyOptions::ToImpl Type Confusion Exploit

Google Chrome 72.0.3626.81 - V8TrustedTypePolicyOptions::ToImpl Type Confusion Exploit VULNERABILITY DETAILS The binding code generator doesn't add checks to ensure that the callback properties of a dictionary are indeed JS functions. For example, for the the TrustedTypePolicyOptions dictionary:...

Google Chrome 72.0.3626.81 - V8TrustedTypePolicyOptions::ToImpl Type Confusion

Google Chrome 72.0.3626.81 - V8TrustedTypePolicyOptions::ToImpl Type Confusion VULNERABILITY DETAILS The binding code generator doesn't add checks to ensure that the callback properties of a dictionary are indeed JS functions. For example, for the the TrustedTypePolicyOptions dictionary:...