Prototype Pollution

chart.js is vulnerable to prototype pollution. The vulnerability exists through the lack of sanitization of the options parameter, allowing an attacker to inject and overwrite arbitrary properties...

The OLE2 parser in Clam AntiVirus (ClamAV) allows remote attackers to cause a denial of service (resource consumption) via an OLE2 file with (1) a large property size or (2) a loop in the FAT file block chain that triggers an infinite loop as demonstrated via a crafted DOC file.

...

mallorcasolproperties.com Cross Site Scripting vulnerability OBB-1432778

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

cyprusinvestmentproperties.com Cross Site Scripting vulnerability OBB-1403098

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Prototype Pollution

simpl-schema is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

cyprusresaleproperties.co.uk Cross Site Scripting vulnerability OBB-1384108

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Prototype Pollution

satetydance is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

bmoor is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the set function...

Information Disclosure

firefox is vulnerable to information disclosure. The vulnerability exists the security wrapper does not deny access to some exposed properties using the deprecated exposedProps mechanism on proxy objects...

CVE-2020-8158

Prototype pollution vulnerability in the TypeORM package 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks...

GHSA-H9WR-XR4R-66FH Cross-Site Scripting in dmn-js-properties-panel

Versions of dmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.3.0 or later...

Cross-Site Scripting in dmn-js-properties-panel

Versions of dmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.3.0 or later...

@quarks/bpmn-extension (>=1.0.0 <=1.0.142) potentially affected by unknown CVE via cmmn-js-properties-panel (=0.4.0)

cmmn-js-properties-panel NPM version =0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on cmmn-js-properties-panel and may be impacted: - @quarks/bpmn-extension =1.0.0, =1.0.142 Source cves: unknown CVE Source advisory: OSV:GHSA-VMH4-322V-CFPC...

GHSA-VMH4-322V-CFPC Cross-Site Scripting in cmmn-js-properties-panel

Versions of cmmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.8.0 or later...

Cross-Site Scripting in cmmn-js-properties-panel

Versions of cmmn-js-properties-panel prior to 0.8.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.8.0 or later...

@dotgov/bpmn (>=0.0.1 <=0.0.29), @dotgov/z_bpmn (>=0.0.1 <=2.0.0) +19 more potentially affected by unknown CVE via bpmn-js-properties-panel (>=0.11.2 <=0.30.0)

bpmn-js-properties-panel NPM version =0.11.2, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.1, =1.1.22, =1.0.97, =2.0.0, =1.0.14, =0.0.1, =0.0.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-VPJ4-89Q8-RH38...

GHSA-VPJ4-89Q8-RH38 Cross-Site Scripting in bpmn-js-properties-panel

Versions of bpmn-js-properties-panel prior to 0.31.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.31.0 or lat...

Cross-Site Scripting in bpmn-js-properties-panel

Versions of bpmn-js-properties-panel prior to 0.31.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.31.0 or lat...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-50966)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.5.1, which can be exploited by an attacker via the "searchName", "searchValue", " searchDescription",...

CVE-2020-24602

Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and...