CVE-2022-0437

Summary: The CVE-2022-0437 issue affects the karma-runner project (NPM package karma) prior to 6.3.14, with a DOM-based cross-site scripting vulnerability in the client-side DOM. The underlying cause is a DOM-based XSS condition that could allow arbitrary JavaScript execution in the victim’s brow...

Karma 跨站脚本漏洞

Karma is a simple tool. Allows JavaScript code to be executed in multiple real browsers. karma has a cross-site scripting vulnerability that stems from the DOM in NPM karma. no details of the vulnerability are currently available...

Cross-site Scripting (XSS) - DOM in karma-runner/karma

Description DOM-based XSS is a vulnerability in which the attacker can inject arbitrary javascript code in any DOM sink that supports dynamic code execution. In our case, source is query parameter returnurl and sink is location.href. Proof of Concept 1 Start karma server and visit the following...

Remote Code Execution (RCE)

karma-mojo is vulnerable to remote code execution RCE. The attack exists because the argument config in the function grep can be manipulated by attacker using malicious code as it was not sanitized before execution...

karma-mojo injection vulnerability

karma-mojo is a package that supports running a selected subset of tests in Karma. An injection vulnerability exists in karma-mojo 1.0.1 and prior versions. The vulnerability stems from a lack of proper validation of user input data by a networked system or product during the course of a user's...

CVE-2020-7626

karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument...

CVE-2020-7626

karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument...

Command injection

karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument...

CVE-2020-7626

CVE-2020-7626 affects the npm package karma-mojo up to version 1.0.1. The vulnerability is a Command Injection due to unsanitized input in the config argument, allowing an attacker to execute arbitrary commands. Multiple connected sources corroborate the issue and identify the impact as arbitrary...

CVE-2020-7626

karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument...

Command Injection

Overview karma-mojo is a plugin for Karma that provides a binary for running only a select subset of tests at a time instead of running the whole test suite. Affected versions of this package are vulnerable to Command Injection. The argument config can be controlled by users without any...

CVE-2011-4090

Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation...

Privilege escalation

Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation...

CVE-2011-4090

Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation...

CVE-2011-4090

Summary: CVE-2011-4090 is tied to Serendipity before 1.6 with an XSS in the karma plugin that may lead to privilege escalation. The vulnerability affects the karma plugin in Serendipity installations prior to version 1.6 (no other products explicitly documented). The underlying issue is a cross-s...

CVE-2011-4090

Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation...

SKA - Simple Karma Attack

SKA allows you to implement a very simple and fast karma attack. You can sniff probe requests to choice the fake AP name or, if you want, you could insert manually the name of the AP evil twin attack. When the target has connected to your WLAN you could active the HTTP redirection and perform a...

Beers with Talos Ep. #46 - Privacy Pwnd: ExileRAT and Collecting Bad Karma

Beers with Talos BWT Podcast Ep. 46 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 46 show notes: Recorded Feb. 1, 2019 Today we discuss threats that bridge the gap between violating privacy and classic...

Hackers used Karma tool to hack iPhones of prominent Govt officials

By Uzair Amir UAE Launched Aggressive Cyber Espionage Campaign using KARMA and Expertise of Ex-NSA Operatives. Though it seems hard to believe it is indeed true that the smartphones of several prominent political and governmental personalities worldwide have been hacked by former US intelligence...

Sql injection

SQL injection vulnerability in the "ContentPlaceHolder1uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter...