7049 matches found
Regular Expression Denial of Service in uglify-js
Versions of uglify-js prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the parse method. Proof of Concept var u = require'uglify-js'; var genstr = function len, chr var result = ""; for i=0; i=len; i++ result = result + chr;...
04_nodeblog (1.0.0), 08cms (1.0.0) +12653 more potentially affected by CVE-2015-8858 via uglify-js (>=2.2.0, <=2.5.0)
uglify-js NPM version =2.2.0, =0.3.0, =0.0.1, =1.0.1, =1.0.0, =0.0.1-alpha, =0.1.1, =0.2.8, =1.5.3 and more Source cves: CVE-2015-8858 Source advisory: OSV:GHSA-C9F4-XJ24-8JQX...
GHSA-34R7-Q49F-H37C Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Versions of uglify-js prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification. Recommendation Upgrade UglifyJS to version = 2.4.24...
04_nodeblog (1.0.0), 0latency (0.0.0) +10643 more potentially affected by CVE-2015-8857 via uglify-js (>=2.2.0, <=2.4.23)
uglify-js NPM version =2.2.0, =0.3.0, =0.0.1, =1.0.1, =1.0.0, =0.0.1-alpha, =0.1.1, =0.2.8, =0.1.0, =0.3.2 and more Source cves: CVE-2015-8857 Source advisory: OSV:GHSA-34R7-Q49F-H37C...
PT-2017-14251 · Unknown · Serialize-To-Js
Name of the Vulnerable Software and Affected Versions: serialize-to-js versions 1.1.1 and earlier Description: The issue allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring. This can be demonstrated by a...
CVE-2017-15871: Loop with Unreachable Exit Condition
The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agrees that...
JS Jobs,1.1.8, RCE
JS Jobs, 1.1.8, Remote code execution - includes free and pro versions resolution: update to 1.1.9 update notice: http://www.joomsky.com/products/js-jobs.html...
nodejs: Constant Hashtable Seeds vulnerability
It was found that Node.js was using a non-randomized seed when populating hash tables. An attacker, able to supply a large number of inputs, could send specially crafted entries to the Node.js application, maximizing hash collisions to trigger an excessive amount of CPU usage, resulting in a deni...
WordPress WP-Contact-Widgets 1.4.1 Cross Site Scripting Vulnerability
WordPress WP-Contact-Widgets plugin version 1.4.1 suffers from a stored cross site scripting vulnerability. Exploit Title: Stored XSS on wp-contact-widgets 1.4.1 wordpress plugin Exploit Author: Boumediene KADDOUR Publisher: R&D Unit Algerie Telecom Version: 1.4.1 Application website:...
PT-2017-10032
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.3 Description The issue allows remote attackers to conduct cross-domain Flash injection XSF attacks by leveraging code contained within the flashmediaelement.swf file in wp-includes/js/mediaelement/, when...
CVE-2017-15216
MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...
CVE-2017-15216: Improper Neutralization of Input During Web Page Generation
MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js...
PT-2017-13911
Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.4.81 Description The issue is related to a potential reflected XSS in a quickDelete action used to delete a sighting. This is associated with specific files, including...
PT-2017-6548
Name of the Vulnerable Software and Affected Versions phpBugTracker versions prior to 1.7.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via several parameters,...
VK.com: XSS в товарах
Отсутствие фильтрации при поиске в товарах. Не было фильтрации некоторых символов в поиске товаров. Из-за еще одного встроенного фильтра все приравнивалось к ="" и не получалось выполнить js. Выход из ситуации был найден в тот же день, получилось выполнить js:...
Razer US: DOM XSS and Open Redirect on the themes.razerzone.com
We appreciate the report and look forward to working with sp1d3rs in the future. I discovered the Open Redirect on the https://themes.razerzone.com/developers/signin endpoint. The root cause of the redirect was the insecure changing of window.location without validation - the original URL paramet...
Memory corruption
JerryScript 1.0 allows remote attackers to cause a denial of service jmemheapallocblockinternal heap memory corruption or possibly execute arbitrary code via a crafted .js file, because unrecognized \ characters cause incorrect 0x00 characters in bytecode.literal data...
CVE-2017-14749
JerryScript 1.0 allows remote attackers to cause a denial of service jmemheapallocblockinternal heap memory corruption or possibly execute arbitrary code via a crafted .js file, because unrecognized \ characters cause incorrect 0x00 characters in bytecode.literal data...
CVE-2017-14749
CVE-2017-14749 affects JerryScript 1.0. A crafted JavaScript file can trigger a denial of service through jmem_heap_alloc_block_internal heap memory corruption, and possibly allow arbitrary code execution. Root cause is unrecognized backslash characters causing incorrect 0x00 bytes in bytecode.li...
