422 matches found
karma-mojo enables OS Command Injection
karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument...
GHSA-PF8J-VHG8-XMC3 karma-mojo enables OS Command Injection
karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument...
@aws-crypto/example-browser (>=2.2.0, <=3.1.0), @carlosvillu/tester (>=1.0.0-beta.1, <=1.0.0) +52 more potentially affected by CVE-2021-23495 via karma (>=6.1.1, <=6.3.14)
karma NPM version =6.1.1, =2.2.0, =1.0.0-beta.1, =1.0.0-beta.0, =22.0.0-beta.1, =13.0.0-beta.1, =430.0.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =0.6.4, =11.0.0-beta.9, =10.21.0, =4.18.0-beta.0, =0.0.0, =0.0.2 and more Source cves: CVE-2021-23495 Source advisory: SNYK:JS-KARMA-2396325...
Open Redirect
Overview karma is a simple tool that allows you to execute JavaScript code in multiple real browsers. Affected versions of this package are vulnerable to Open Redirect due to missing validation of the returnurl query parameter. Remediation Upgrade karma to version 6.3.16 or higher. References -...
karma cross-site scripting vulnerability
Karma is a simple tool. Allows JavaScript code to be executed in multiple real browsers. karma has a cross-site scripting vulnerability that stems from the DOM in NPM karma. no details of the vulnerability are currently available...
GHSA-7X7C-QM48-PQ9C Cross-site Scripting in karma
karma prior to version 6.3.14 contains a cross-site scripting vulnerability...
Cross-site Scripting in karma
karma prior to version 6.3.14 contains a cross-site scripting vulnerability...
@aws-crypto/example-browser (>=2.2.0, <=3.1.0), @carlosvillu/tester (>=1.0.0-beta.1, <=1.0.0) +51 more potentially affected by CVE-2022-0437 via karma (>=6.1.1, <=6.3.13)
karma NPM version =6.1.1, =2.2.0, =1.0.0-beta.1, =1.0.0-beta.0, =22.0.0-beta.1, =13.0.0-beta.1, =430.0.0, =3.7.0, =3.7.0, =3.7.0, =3.7.0, =0.6.4, =11.0.0-beta.9, =10.21.0, =4.18.0-beta.0, =0.0.0, =0.0.2 and more Source cves: CVE-2022-0437 Source advisory: OSV:GHSA-7X7C-QM48-PQ9C...
CVE-2022-0437
Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...
CVE-2022-0437
Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...
Cross site scripting
Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...
CVE-2022-0437 Cross-site Scripting (XSS) - DOM in karma-runner/karma
Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...
CVE-2022-0437 Cross-site Scripting (XSS) - DOM in karma-runner/karma
Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...
EUVD-2022-0897
Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...
CVE-2022-0437
Summary: The CVE-2022-0437 issue affects the karma-runner project (NPM package karma) prior to 6.3.14, with a DOM-based cross-site scripting vulnerability in the client-side DOM. The underlying cause is a DOM-based XSS condition that could allow arbitrary JavaScript execution in the victim’s brow...
Karma 跨站脚本漏洞
Karma is a simple tool. Allows JavaScript code to be executed in multiple real browsers. karma has a cross-site scripting vulnerability that stems from the DOM in NPM karma. no details of the vulnerability are currently available...
Cross-site Scripting (XSS) - DOM in karma-runner/karma
Description DOM-based XSS is a vulnerability in which the attacker can inject arbitrary javascript code in any DOM sink that supports dynamic code execution. In our case, source is query parameter returnurl and sink is location.href. Proof of Concept 1 Start karma server and visit the following...
Remote Code Execution (RCE)
karma-mojo is vulnerable to remote code execution RCE. The attack exists because the argument config in the function grep can be manipulated by attacker using malicious code as it was not sanitized before execution...
karma-mojo injection vulnerability
karma-mojo is a package that supports running a selected subset of tests in Karma. An injection vulnerability exists in karma-mojo 1.0.1 and prior versions. The vulnerability stems from a lack of proper validation of user input data by a networked system or product during the course of a user's...