CVE-2022-24434

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes...

CVE-2022-25224

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

Design/Logic Flaw

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

CVE-2022-25229

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

CVE-2022-25229

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

Cross site scripting

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

CVE-2022-25224

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

CVE-2022-25224

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

CVE-2022-25229

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

CVE-2022-25229

CVE-2022-25229 affects Popcorn Time 0.4.7. A Stored XSS vulnerability originates in the Settings page, in the Movies API Server(s) field, where lack of input validation allows injection of script. The issue is aggravated by nodeIntegration being turned on, which can permit the webpage to access N...

CVE-2022-24434: Undefined Security Weakness

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes...

CVE-2022-25224: Improper Neutralization of Input During Web Page Generation

Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration'...

SUSE-SU-2022:1694-1 Security update for nodejs8

This update for nodejs8 fixes the following issues: - CVE-2021-44906: Fixed prototype pollution in npm dependency bsc1198247. - CVE-2021-44907: Fixed insuficient sanitation in npm dependency bsc1197283. - CVE-2022-0235: Fixed passing of cookie data and sensitive headers to different hostnames in...

org.jenkins-ci.plugins:nodejs (>=1.2.5, <=1.2.6) potentially affected by CVE-2018-1000413 via org.jenkins-ci.plugins:config-file-provider (2.16.4)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:nodejs =1.2.5, =1.2.6 Source cves: CVE-2018-10004...

org.jenkins-ci.plugins:nodejs (>=1.0, <=1.2.1) potentially affected by CVE-2018-1000413 via org.jenkins-ci.plugins:config-file-provider (2.15.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:nodejs =1.0, =1.2.1 Source cves: CVE-2018-1000413...

org.jenkins-ci.plugins:nodejs (>=1.0, <=1.2.1) potentially affected by CVE-2018-1000414 via org.jenkins-ci.plugins:config-file-provider (2.15.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:nodejs =1.0, =1.2.1 Source cves: CVE-2018-1000414...

com.lookout.jenkins:environment-script (1.2.5), org.jenkins-ci.plugins:ivy (>=1.23, <=2.2) +9 more potentially affected by CVE-2017-1000104 via org.jenkins-ci.plugins:config-file-provider (>=2.0, <=2.16.0)

org.jenkins-ci.plugins:config-file-provider MAVEN version =2.0, =1.23, =2.11, =1.25, =1.0, =1.5, =0.1-beta, =1.0, =0.9.0, =0.3, =1.3 Source cves: CVE-2017-1000104 Source advisory: GHSA-6H72-M3XW-FP3C...

org.jenkins-ci.plugins:nodejs (>=1.0, <=1.2.1) potentially affected by CVE-2019-1003014 via org.jenkins-ci.plugins:config-file-provider (2.15.5)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.15.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:nodejs =1.0, =1.2.1 Source cves: CVE-2019-1003014...

org.jenkins-ci.plugins:nodejs (>=1.2.5, <=1.2.6) potentially affected by CVE-2019-1003014 via org.jenkins-ci.plugins:config-file-provider (2.16.4)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:nodejs =1.2.5, =1.2.6 Source cves: CVE-2019-10030...

org.jenkins-ci.plugins:nodejs (>=1.2.2, <=1.2.4), org.jenkins-ci.plugins:pipeline-maven (>=3.0.0-beta-1, <=3.5.12) +1 more potentially affected by CVE-2019-1003014 via org.jenkins-ci.plugins:config-file-provider (2.16.0)

org.jenkins-ci.plugins:config-file-provider MAVEN version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:config-file-provider and may be impacted: - org.jenkins-ci.plugins:nodejs =1.2.2, =3.0.0-beta-1, =3.5.12 -...