185 matches found
PT-2024-29502 · Qwik +1 · Qwik +1
Name of the Vulnerable Software and Affected Versions: Qwik versions prior to 1.6.0 @builder.io/qwik versions prior to 1.7.3 Description: A potential mutation XSS vulnerability exists in Qwik due to improper HTML escaping on server-side rendering. This occurs because Qwik converts strings accordi...
Qwik 安全漏洞
Qwik is a micro web framework open-sourced by Qwik Dev. A security vulnerability exists in Qwik version 1.6.0 and earlier versions that stems from incorrectly escaping HTML during server-side rendering, resulting in a cross-site scripting vulnerability...
qwik-lottie (>=0.0.5, <=0.0.6), storybook-framework-qwik (>=0.0.1, <=0.0.4) potentially affected by CVE-2023-2307 via @builder.io/qwik-city (>=0.0.112, <=0.0.128)
@builder.io/qwik-city NPM version =0.0.112, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2023-2307 Source advisory: OSV:GHSA-C54W-7J5F-XG98...
@builder.io/qwik-city Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery CSRF in GitHub repository builderio/qwik prior to 0.104.0...
GHSA-C54W-7J5F-XG98 @builder.io/qwik-city Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery CSRF in GitHub repository builderio/qwik prior to 0.104.0...
CVE-2023-2307 Cross-Site Request Forgery (CSRF) in builderio/qwik
Cross-Site Request Forgery CSRF in GitHub repository builderio/qwik prior to 0.104.0...
qwik 跨站请求伪造漏洞
qwik is a micro web framework. A cross-site request forgery vulnerability exists in qwik versions prior to 0.104.0. An attacker could exploit this vulnerability to perform a cross-site request forgery attack...
CVE-2023-2307
CVE-2023-2307 describes a Cross-Site Request Forgery (CSRF) vulnerability in the GitHub repository for builderio/qwik. The vulnerability affects versions prior to 0.104.0, where an attacker could abuse CSRF to perform unintended actions in scoped user contexts. Public sources consistently referen...
CVE-2023-2307 Cross-Site Request Forgery (CSRF) in builderio/qwik
Cross-Site Request Forgery CSRF in GitHub repository builderio/qwik prior to 0.104.0...
PT-2023-18831
Name of the Vulnerable Software and Affected Versions builderio/qwik versions prior to 0.104.0 Description The issue is related to Cross-Site Request Forgery CSRF in the GitHub repository builderio/qwik. Recommendations For versions prior to 0.104.0, update to version 0.104.0 or later to resolve...
CVE-2023-2307 Cross-Site Request Forgery (CSRF) in builderio/qwik
Cross-Site Request Forgery CSRF in GitHub repository builderio/qwik prior to 0.104.0...
CSRF bypass
Description URL parsing with Qwik uses the new URLa, b constructor. A little-known fact about this constructor is that if an attacker controls a they have complete control of the finally resolved URL. For example: const url = new URLattackervalue, "http://localhost" By entering //test.com, we can...
Qwik < 0.21.0 Code Injection
Qwik in version 0.21.0 provides an extended serialization mechanism for exchanging data between the client and server. Through a specially crafted request on the endpoint /q-data.json, an unauthenticated attacker is able to inject code and execute arbitrary commands No source data...
Code Injection
@builder.io/qwik, is vulnerable to Code Injection. The vulnerability is caused by the PureFunctionSerializer function in serializers.ts due to a lack of sanitization when deserializing data types, which allows an attacker to inject and execute malicious JavaScript into the server...
@leifermendez/partytown-qwik (>=1.0.3, <=1.0.7), cypress-ct-jordan-qwik (>=0.0.0-alpha-10, <=0.0.0-alpha-9) +1 more potentially affected by CVE-2023-1283 via @builder.io/qwik (>=0.9.0, <=0.18.1)
@builder.io/qwik NPM version =0.9.0, =1.0.3, =0.0.0-alpha-10, =0.0.0-alpha-9 - storybook-framework-qwik 0.0.1 Source cves: CVE-2023-1283 Source advisory: OSV:GHSA-9WF9-QVVP-2929...
CVE-2023-1283
Code Injection in GitHub repository builderio/qwik prior to 0.21.0...
Code injection
Code Injection in GitHub repository builderio/qwik prior to 0.21.0...
CVE-2023-1283
CVE-2023-1283 affects builderio/qwik versions prior to 0.21.0. The vulnerability arises from the deserializer exposed via the pureServerFunction feature, enabling an unauthenticated attacker to inject and run arbitrary JavaScript code (via a crafted request to /q-data.json). Impact is code execut...