CVE-2015-8858

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service CPU consumption via crafted input in a parse call, aka a "regular expression denial of service ReDoS."...

CVE-2015-8858

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service CPU consumption via crafted input in a parse call, aka a "regular expression denial of service ReDoS."...

CVE-2015-8857

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript...

04_nodeblog (1.0.0), 0latency (0.0.0) +15276 more potentially affected by CVE-2015-8857 via uglify-js (>=0.0.1, <=2.4.23)

uglify-js NPM version =0.0.1, =0.3.0, =0.0.1, =1.0.2, =1.0.1, =1.0.0, =0.0.1-alpha, =0.1.1, =0.1.2 and more Source cves: CVE-2015-8857 Source advisory: MEND:CVE-2015-8857...

CVE-2015-8858

CVE-2015-8858 : The vulnerability affects the uglify-js package before 2.6.0 used in Node.js, where a crafted input to parse() can trigger a regular expression denial of service (ReDoS) and cause high CPU usage. Root cause is a flaw in the regular expression handling within the parser. Impact is ...

CVE-2015-8857

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript...

CVE-2015-8857

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript...

04_nodeblog (1.0.0), 08cms (1.0.0) +17219 more potentially affected by CVE-2015-8858 via uglify-js (>=0.0.1, <=2.5.0)

uglify-js NPM version =0.0.1, =0.3.0, =0.0.1, =1.0.2, =1.0.1, =1.0.0, =0.0.1-alpha, =1.0.0 - 3vot-clay 2.0.1 and more Source cves: CVE-2015-8858 Source advisory: MEND:CVE-2015-8858...

CVE-2015-8858

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service CPU consumption via crafted input in a parse call, aka a "regular expression denial of service ReDoS."...

CVE-2015-8858: Undefined Security Weakness

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service CPU consumption via crafted input in a parse call, aka a "regular expression denial of service ReDoS."...

CVE-2015-8857: Undefined Security Weakness

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript...

PT-2017-4099

Name of the Vulnerable Software and Affected Versions uglify-js versions prior to 2.4.24 Description The issue is related to errors in input syntax checking in the uglify-js library, which may allow a remote attacker to execute arbitrary code using a specially crafted JavaScript. The vulnerabilit...

PT-2017-4098

Name of the Vulnerable Software and Affected Versions uglify-js versions prior to 2.6.0 Description The issue allows attackers to cause a denial of service CPU consumption via crafted input in a parse call, also known as a "regular expression denial of service ReDoS". This can be exploited by...

VK.com: HTML Injection possible due to bad filter

Hello, I have found an area where it may be possible to run certain HTML/JS scripts. TO REPRODUCE: 1. Go to documents 2. Upload anything and edit it 3. On the edit page in tags, enter code without a closing bracket ex. img src=x 4. Click enter 5. It will be parsed in that area, but after saving i...

Rockstar Games: [IMP] - Blind XSS in the admin panel for reviewing comments

@anshumanbh discovered that it is possible to exploit a Blind XSS vulnerability under the "MOUTHOFF TO ROCKSTAR" section while providing feedback. The result is a XSS vulnerability being exploited on an internal Rockstar Games domain. The way this worked was that an attacker would submit a...

Fedora 24 : js-jquery (2016-8516b7d6fb)

Update to 2.2.4 with backport for XSS vulnerability. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issue...

Fedora 25 : js-jquery1 (2016-b6cb3e83fa)

Update to latest jquery1 stable, with backport fix for XSS vulnerability. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora Update for js-jquery1 FEDORA-2016-06e8a3f776

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for js-jquery FEDORA-2016-8516b7d6fb

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for js-jquery1 FEDORA-2016-b6cb3e83fa

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...