125 matches found
MAL-2022-6014 Malicious code in seo-pwa (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01c37266af6c18bad1316dca279dd5472b77ca972098bb6af7c85853f6559d8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
@ampersandhq/disable-proxy-ssl-verification (0.0.1), @deg-skeletor/plugin-express (>=1.4.0, <=1.4.8) +21 more potentially affected by CVE-2022-1929 via devcert (>=1.0.0, <=1.2.0)
devcert NPM version =1.0.0, =1.4.0, =1.0.0, =0.0.1, =1.0.0, =13.3.0, =0.0.18, =0.0.1, =1.0.0-alpha.1, =2.0.0-rc.15, =2.0.0-rc.3, =14.5.1 and more Source cves: CVE-2022-1929 Source advisory: OSV:GHSA-FP36-299X-PWMW...
GHSA-9WXJ-37P8-49FF Diavante vue-storefront-api and storefront-api disclose stack trace
In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...
CVE-2021-24906
The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin and therefore the protection offered via a crafted request...
Bugs-feed - A Local Hosted Portal Where You Can Search For The Latest News, Videos, CVEs, Vulnerabilities...
Bug's feed is a local hosted portal where you can search for the latest news, videos, CVEs, vulnerabilities... It's implemented as a PWA application so you can get rid of the explorer and use it as a desktop application. Navigate through different tabs and take a look to the latest bugs or search...
PWA for WP & AMP < 1.7.33 - Authenticated (Subscriber+) Arbitrary File Upload
The plugin did not have a capability check in its pwaforwpsplashscreenuploader function, and relied on CSRF check, however, the nonce was available to any authenticated user. As a result, any authenticated user such as a subscriber could call it and upload a malicious zip file containing a shell...
WordPress PWA for WP & AMP plugin <= 1.7.32 - Authenticated Arbitrary File Upload vulnerability
Authenticated Arbitrary File Upload vulnerability discovered by Jerome Bruandet in WordPress PWA for WP & AMP plugin versions = 1.7.32. Solution Update the WordPress PWA for WP & AMP plugin to the latest available version at least 1.7.33...
@deg-skeletor/plugin-express (>=1.4.0, <=1.4.8), @magento/create-pwa (>=1.0.0-alpha.1, <=3.0.0-alpha.4) +5 more potentially affected by CVE-2020-8186 via devcert (>=1.0.0, <=1.1.1)
devcert NPM version =1.0.0, =1.4.0, =1.0.0-alpha.1, =2.0.0-rc.15, =2.0.0-rc.3, =0.0.99, =1.0.0, =1.0.0, =1.0.5 Source cves: CVE-2020-8186 Source advisory: OSV:GHSA-4228-7QVX-F4RQ...
Authorization Bypass
chromium is vulnerable to authorization bypass. The vulnerability exists through an incorrect security UI that allows a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox URL bar via a crafted PWA...
Timers, Metrics, and Dimensions: What's New in mPulse in 2020
The October 2020 release marks the culmination of a large number of updates to mPulse, Akamai's real user monitoring RUM solution: 8 New timers 2 New metrics 5 New dimensions UI improvements Extra custom timer capabilities With all of these new changes, you can easily determine and tune the...
CVE-2020-6536
Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox URL bar via a crafted PWA...
Code injection
Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox URL bar via a crafted PWA...
CVE-2020-6536
Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox URL bar via a crafted PWA...
CVE-2020-6536
Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox URL bar via a crafted PWA...
CVE-2020-6536
CVE-2020-6536 affects Google Chrome/Chromium PWAs. Root cause: Incorrect security UI in PWAs allowed a crafted PWA to spoof the Omnibox (URL bar). Impact: potential for spoofing the address bar content via a remote PWA installation. Remediation: update to Chrome/Chromium 84.0.4147.89 (stable chan...
CVE-2020-6536
Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox URL bar via a crafted PWA...
CVE-2020-6536
Incorrect security UI in PWAs in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had persuaded the user to install a PWA to spoof the contents of the Omnibox URL bar via a crafted PWA...
Code injection
In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...
CVE-2018-6083
Failure to disallow PWA installation from CSP sandboxed pages in AppManifest in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to access privileged APIs via a crafted HTML page...