PT-2021-4690 · Foxit · Foxit Pdf Reader +2

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader versions prior to 11.1 Foxit PDF Editor versions prior to 11.1 Foxit PhantomPDF versions prior to 10.1.6 Description: The issue is related to the mishandling of JavaScript, allowing attackers to trigger a use-after-free and...

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to trigger a service failure.

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to operations that go beyond buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

CVE-2021-40711

Adobe Experience Manager version 6.5.9.0 and earlier is affected by a stored XSS vulnerability when creating Content Fragments. An authenticated attacker can send a malformed POST request to achieve arbitrary code execution. Malicious JavaScript may be executed in a victim’s browser when they...

Sandbox Bypass

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine. PoC const VM = require"vm2...

PT-2021-14783 · Nitro · Nitro Pro Pdf

Name of the Vulnerable Software and Affected Versions: Nitro Pro PDF affected versions not specified Description: An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can cause a stack variable to go o...

Nitro Software Nitro Pro 安全漏洞

Nitro Software Nitro Pro is a U.S. Nitro Software PDF document editor software. The software supports PDF document editing, PDF document format conversion and PDF document encryption and other functions. A security vulnerability exists in the JavaScript implementation of Nitro Software Nitro Pro,...

Chrome JS WasmJs::InstallConditionalFeatures Object Corruption

Chrome: JS object corruption in WasmJs::InstallConditionalFeatures VULNERABILITY DETAILS void WasmJs::InstallConditionalFeaturesIsolate isolate, Handle context // Exception handling may have been enabled by an origin trial. If so, make // sure that the WebAssembly.Exception constructor is set up...

Foxit Reader 资源管理错误漏洞

Foxit PDF Reader is a PDF reader. Foxit PDF Reader handles Javascript with a security vulnerability that can be exploited by attackers to execute arbitrary code...

Foxit PDF Reader 资源管理错误漏洞

Foxit PDF Reader is a PDF reader. Foxit PDF Reader handles Javascript security vulnerabilities, which can be exploited by attackers to execute arbitrary code...

nodejs 缓冲区错误漏洞

nodejs is a JavaScript runtime environment based on the ChromeV8 engine by wrapping the Chromev8 engine and the use of event-driven and non-blocking IO applications to make the development of high-performance Javascript background applications possible. A buffer error vulnerability exists in...

Prototype Pollution

Overview record-like-deep-assign is a Recursively assigns enumerable own properties of the given sources to a target object Affected versions of this package are vulnerable to Prototype Pollution via the main functionality. PoC const deepAssign = require'record-like-deep-assign'; let obj = ;...

Facebook Hermes Input Validation Error Vulnerability

Facebook Hermes is a JavaScript engine from Facebook, Inc. The engine is targeted at React Native applications to improve the performance of mobile client application apps, but is not applicable to server-side infrastructures such as browsers ＆ Node.js. An input validation error vulnerability...

Jira Server and Jira Data Center cross-site scripting vulnerability (CNVD-2021-44762)

Atlassian JIRA Server and Jira Server & Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. The system is mainly used for tracking and managing all kinds of problems and defects in the workplace.Jira Server & Dat...

The vulnerability of the uglify-js library in the Aurora application software involves an uncontrolled resource consumption, allowing attackers to cause service failures.

The vulnerability of the uglify-js library in Aurora application software is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to deny services through the use of a specially crafted regular expression...

IBM Engineering Test Management Cross-Site Scripting Vulnerability (CNVD-2021-39247)

IBM Engineering Test Management is a collaborative quality management solution that provides end-to-end test planning and test asset management, with broad coverage of all aspects from requirements to defects. A cross-site scripting vulnerability exists in IBM Engineering Test Management version...

GHSA-C94V-8FFF-73PH Command Injection in @theia/messages

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run...

IBM Content Navigator Cross-Site Scripting Vulnerability (CNVD-2021-32636)

IBM Content Navigator is a Web client from IBM USA. The product supports searching and processing documents stored in content servers from a Web browser. A cross-site scripting vulnerability exists in IBM Content Navigator version 3.0.CD. An attacker can exploit the vulnerability to embed arbitra...

CVE-2021-24205

In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget includes/widgets/icon-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifi...

BaserCMS JavaScript Input Improper Neutralization Vulnerability (CNVD-2021-23789)

BaserCMS is an open source enterprise-level content management system cms. A JavaScript Input Improper Neutralization vulnerability exists in the page editing feature in BaserCMS versions prior to 4.4.5. A remote authenticated attacker can exploit this vulnerability to inject arbitrary scripts...

CVE-2021-29009

SEO Panel 4.8.0 is affected by a cross-site scripting (XSS) vulnerability. The issue arises in archive.php via the type parameter, allowing remote attackers to inject JavaScript. Documented impact includes partial integrity and low confidentiality impact with network attack vector and user intera...