@bigab/gulp-testee (>=0.0.1, <=0.0.2), books-fe-polymer-dev-sample (1.0.0) +13 more potentially affected by CVE-2021-23330 via launchpad (>=0.2.1, <=0.7.5)

launchpad NPM version =0.2.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =1.0.1, =0.2.0, =0.0.1, =0.0.5, =2.0.15, =1.0.1, =2.0.3, =3.4.2 Source cves: CVE-2021-23330 Source advisory: SNYK:JS-LAUNCHPAD-1044065...

Command Injection

Overview launchpad is a You can launch browsers! From NodeJS! Local ones! Remote ones! Browserstack ones! Affected versions of this package are vulnerable to Command Injection via stop. Remediation Upgrade launchpad to version 0.8.0 or higher. References - GitHub Commit - GitHub Issue - GitHub PR...

SAP Fiori Launchpad Cross-Site Scripting Vulnerability

SAP Fiori is SAP's user experience UX design system for SAP applications, which provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, providing a consistent, innovative experience for creators and users.SAP Fiori Launchpad is the SA...

CVE-2020-26825

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26825

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

CVE-2020-26825

SAP Fiori Launchpad News tile (News tile Application) suffers a Reflected XSS in versions 750–755 due to insufficient encoding of user-controlled inputs, enabling an unauthenticated attacker to send malicious code that can be read and potentially modified in the victim’s browser. Impact per recor...

PT-2020-16510

Name of the Vulnerable Software and Affected Versions SAP Fiori Launchpad News tile Application versions 750 through 755 Description The issue allows an unauthorized attacker to send malicious code to a different end user victim using the SAP Fiori Launchpad News tile Application. This is due to...

CVE-2020-26825: Improper Neutralization of Input During Web Page Generation

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to use SAP Fiori Launchpad News tile Application to send malicious code, to a different end user victim, because News tile does not sufficiently encode user controlled inputs, resulting ...

SAP Fiori Launchpad Server-Side Request Forgery Vulnerability

SAP Fiori is SAP's user experience UX design system for SAP applications, which provides designers and developers with a set of tools and guidelines to quickly develop applications for any platform, providing a consistent, innovative experience for creators and users.SAP Fiori Launchpad is the SA...

CVE-2020-26815

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

CVE-2020-26815

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

Server side request forgery (ssrf)

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

CVE-2020-26815

CVE-2020-26815 concerns SAP Fiori Launchpad News tile Application, affected in versions 750–755. The connected sources describe a Server-Side Request Forgery (SSRF) vulnerability where an unauthenticated attacker can send a crafted request to a vulnerable web application, potentially exposing sen...

CVE-2020-26815

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

PT-2020-16500

Name of the Vulnerable Software and Affected Versions SAP Fiori Launchpad News tile Application versions 750,751,752,753,754,755 Description The issue allows an unauthorized attacker to send a crafted request to a vulnerable web application, typically used to target internal systems behind...

CVE-2020-26815: Server-Side Request Forgery (SSRF)

SAP Fiori Launchpad News tile Application, versions - 750,751,752,753,754,755, allows an unauthorized attacker to send a crafted request to a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external...

CVE-2019-11556

Pagure before 5.6 allows XSS via the templates/blame.html blame view...

CVE-2020-6283

SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting XSS vulnerability. With a successful attack, the attacker can steal...

CVE-2020-6283

SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting XSS vulnerability. With a successful attack, the attacker can steal...

Cross site scripting

SAP Fiori Launchpad does not sufficiently encode user controlled inputs, and hence allowing the attacker to inject the meta tag into the launchpad html using the vulnerable parameter, resulting in reflected Cross-Site Scripting XSS vulnerability. With a successful attack, the attacker can steal...