446 matches found
CVE-2025-57328
toggle-array is a package designed to enables a property on the object at the specified index, while disabling the property on all other objects. A Prototype Pollution vulnerability in the enable and disable function of toggle-array v1.0.1 and before allows attackers to inject properties on...
Security Bulletin: TS4500 Tape Library/Diamondback Tape Library addresses security vulnerability CVE-2021-23450
Summary The tape library web GUI used an outdated version of the JavaScript library dojo.js containing a prototype pollution vulnerability. This could potentially be leveraged to facilitate XSS attacks in the browser, or, if executed server-side, to enable remote code execution. The issue has bee...
GHSA-G38C-WXJF-XRH6 `git-comiters` Command Injection vulnerability
Background on the vulnerability This vulnerability manifests with the library's primary exported API: gitCommitersoptions, callback which allows specifying options such as cwd for current working directory and revisionRange as a revision pointer, such as HEAD. However, the library does not saniti...
Malicious code in javascript-auth0-selenology-blaze (npm)
The package javascript-auth0-selenology-blaze was found to contain malicious code...
libmozjs-128-0-128.14.0-1.1 on GA media (moderate)
libmozjs-128-0-128.14.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15494-1 Rating: moderate Cross-References: CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9185 CVSS scores: CVE-2025-9179 SUSE : 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-9180 SUSE : 8.1...
CVE-2025-57810
CVE-2025-57810 affects the jsPDF library. The issue arises when user control of the first argument to addImage allows untrusted image data/URLs to trigger high CPU usage, leading to denial of service. This vulnerability is present in versions prior to 3.0.2 and was fixed in jsPDF 3.0.2. Impact is...
PT-2025-34787
Name of the Vulnerable Software and Affected Versions: jsPDF versions prior to 3.0.2 Description: jsPDF is a JavaScript library used to generate PDFs. Prior to version 3.0.2, user control over the first argument of the addImage method can lead to high CPU utilization and denial of service...
Ubuntu 20.04 LTS : qs vulnerability (USN-7693-1)
The remote Ubuntu 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-7693-1 advisory. Nathanael Braun and Johan Brissaud discovered that qs was vulnerable to prototype pollution. A remote attacker could possibly use this issue to cause a denial of...
Malicious code in @zalastax/nolb-react-tx (npm)
The package @zalastax/nolb-react-tx was found to contain malicious code...
Malicious code in javascript-astrochemistry-panspermia-mongoose (npm)
The package javascript-astrochemistry-panspermia-mongoose was found to contain malicious code...
Malicious code in lexicrypt (npm)
The package lexicrypt was found to contain malicious code...
MAL-2025-29403 Malicious code in pleyus (npm)
The package pleyus was found to contain malicious code...
MAL-2025-27195 Malicious code in nectar-4fmc5-0l8ls-juniper-project (npm)
The package nectar-4fmc5-0l8ls-juniper-project was found to contain malicious code...
MAL-2025-27199 Malicious code in nectar-glisten-nom856-project (npm)
The package nectar-glisten-nom856-project was found to contain malicious code...
MAL-2025-22025 Malicious code in gt.ui.common (npm)
The package gt.ui.common was found to contain malicious code...
MAL-2025-19909 Malicious code in europa-indus-puppeteer-polaris (npm)
The package europa-indus-puppeteer-polaris was found to contain malicious code...
MAL-2025-16414 Malicious code in c8front (npm)
The package c8front was found to contain malicious code...
MAL-2025-19605 Malicious code in emerald-kelp-yye726-project (npm)
The package emerald-kelp-yye726-project was found to contain malicious code...