CVE-2021-29489

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

Debian DSA-4886-1 : chromium - security update

Several vulnerabilites have been discovered in the chromium web browser. - CVE-2021-21159 Khalil Zhani discovered a buffer overflow issue in the tab implementation. - CVE-2021-21160 Marcin Noga discovered a buffer overflow issue in WebAudio. - CVE-2021-21161 Khalil Zhani discovered a buffer...

[SECURITY] [DSA 4883-1] underscore security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4883-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 01, 2021 https://www.debian.org/security/faq -...

Design/Logic Flaw

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated...

CVE-2018-1107

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated...

UBUNTU-CVE-2021-27292

ua-parser-js = 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time...

The vulnerability of the `dojox.xmpp.util.xmlEncode` component in the dojox JavaScript library allows a attacker to compromise data integrity.

The vulnerability of the dojox.xmpp.util.xmlEncode component in the dojox JavaScript library is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

Debian DSA-4858-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2021-21148 Mattias Buelens discovered a buffer overflow issue in the v8 JavaScript library. - CVE-2021-21149 Ryoya Tsukasaki discovered a stack overflow issue in the Data Transfer implementation. - CVE-2021-21150 Wooj...

Debian: Security Advisory (DSA-4858-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-27405

A ReDoS regular expression denial of service flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js...

@frostoven/alkalurops (>=1.28.2, <=1.28.5), @h5web/app (>=0.1.0-beta.1, <=4.2.0-beta.1) +14 more potentially affected by unknown CVE via d3-color (3.0.1)

d3-color NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on d3-color and may be impacted: - @frostoven/alkalurops =1.28.2, =0.1.0-beta.1, =0.1.0-beta.0, =0.1.1, =1.0.1, =0.2.0, =0.1.6, =0.1.1, =0.2.0, =0.2.0, =0.0.2, =0.3.0, =0.1.0, =0.3...

Debian DSA-4846-1 : chromium - security update

Several vulnerabilities have been discovered in the chromium web browser. - CVE-2020-16044 Ned Williamson discovered a use-after-free issue in the WebRTC implementation. - CVE-2021-21117 Rory McNamara discovered a policy enforcement issue in Cryptohome. - CVE-2021-21118 Tyler Nighswander discover...

Shinuza Decimal-js Security Vulnerability

Shinuza Decimal-js is a Javascript-based codebase used to provide decimal calculations for Node applications by Shinuza Individual Developers. A security vulnerability exists in Shinuza Decimal-js, which stems from the extend function...

@convergence/jointjs-utils (0.4.0), aihub (>=1.0.1, <=1.0.2) +7 more potentially affected by CVE-2020-28480 via jointjs (>=3.1.0, <=3.2.0)

jointjs NPM version =3.1.0, =1.0.1, =1.0.6, =1.0.1, =1.0.1, =0.9.0, =0.10.1 - ublatt 1.2.0 - vue-erd 0.1.1 - vue-test-demo-one 0.1.0 Source cves: CVE-2020-28480 Source advisory: SNYK:JS-JOINTJS-1024444...

Immer Security Breach

Immer is a Javascript-based state management library for the Immer community. A security vulnerability exists in all versions of Immer. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

Bigpipe predefine security breach

Bigpipe Predefine is a code library for managing Object.defineProperties objects in the Javascript language by the Bigpipe individual developers. A security vulnerability exists in predefine versions 0.0.0 through 0.1.2 that can be exploited by an attacker to cause a denial of service and...

date-and-time denial-of-service vulnerability

Date And Time is Date And Time personal developer of a Javascript-based for processing JS date and time Npm code library . A security vulnerability exists in versions prior to date-and-time 0.14.2, which stems from regular expression exception handling involving parsing, resulting in a...

Mout deepFillIn Code Issue Vulnerability

Mout is a Javascript-based code library from the Mout team that provides modular support for JS programming. Mout suffers from a security vulnerability that stems from the fact that the deepFillIn function can be used to "recursively fill in missing attributes" while deepMixIn "mixes objects into...

Regular Expression Denial of Service (ReDoS)

Overview @absolunet/kafe is a Javascript utility library. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS. It allows cause a denial of service when validating crafted invalid emails. Details Denial of Service DoS describes a family of attacks, all...

TinyMCE XSS vulnerability on version 4.7.11

h4. Description It seems that Confluence bundles a version of TinyMCE within the editor that has an XSS vulnerability. Confluence version 7.4.1 uses version 0.4.34 of the confluence-editor plugin that includes 4.7.11 of TinyMCE as a dependency Confluence version 7.6.2 uses version 0.4.41 of the...