Malicious JavaScript Package Detection

Detection and reporting of known malicious JavaScript packages or package versions. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

CVE-2016-10678

serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or...

Remote code execution

serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or...

Malicious Package

Overview Version 8.4.3 of rc-calendar-jhorst contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 8.4.3 of this module is found...

macOS : Apple Safari 11.1 APPLE-SA-2018-04-24-3 Multiple Vulnerabilities

The version of Apple Safari installed on the remote macOS or Mac OS X host is 11.1, but is missing the security fix APPLE-SA-2018-04-24-3. It is, therefore, affected by multiple vulnerabilities as described in the HT208741 security advisory. C Tenable Network Security, Inc. include"compat.inc"; i...

WordPress Caldera Forms plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Caldera Forms is a drag-and-drop web editor plugin used in ... A cross-site scripting vulnerability exists in WordPress...

rc-tuning-teile.de Improper Access Control vulnerability

Open Bug Bounty ID: OBB-578972 Description| Value ---|--- Affected Website:| rc-tuning-teile.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...

UBUNTU-CVE-2017-18184

An issue was discovered in QPDF before 7.0.0. There is a stack-based out-of-bounds read in the function iteraterc4 in QPDFencryption.cc...

rc-motorradshop.de XSS vulnerability

Open Bug Bounty ID: OBB-556567 Description| Value ---|--- Affected Website:| rc-motorradshop.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-10707

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...

CVE-2016-10707: Uncontrolled Recursion

jQuery 3.0.0-rc.1 is vulnerable to Denial of Service DoS due to removing a logic that lowercased attribute names. Any attribute getter using a mixed-cased name for boolean attributes goes into an infinite recursion, exceeding the stack call limit...

rc-online.ru XSS vulnerability

Open Bug Bounty ID: OBB-488435 Description| Value ---|--- Affected Website:| rc-online.ru Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosure Standard:| Coordinated Disclosure based ...

Netwide Assembler Heap Buffer Overflow Vulnerability

Netwide Assembler NASM is a Linux-based assembler that creates binaries and writes bootloaders. A heap buffer overflow vulnerability exists in NASM version 2.14rc0. A remote attacker could exploit this vulnerability to cause a denial of service...

Linux kernel local denial of service vulnerability (CNVD-2017-33100)

The Linux kernel is the kernel used by the operating system Linux, released by the Linux Foundation in the United States. A local denial of service vulnerability exists in the 'imonprobe' function in the drivers/media/rc/imon.c file in Linux kernel 4.13.11 and earlier versions. A local attacker c...

CVE-2017-16537

The imonprobe function in drivers/media/rc/imon.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact via a crafted USB device...

SQL Injection in sequelize

Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 or later...

PT-2017-3148

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.13.11 Description The issue is related to the imon probe function in the Linux kernel, specifically in the drivers/media/rc/imon.c file. It is associated with pointer dereference errors. Exploitation of this...

P3Scan Design Vulnerabilities

P3Scan is a proxy server for email that scans for worms, Trojans and other malicious emails. A security vulnerability exists in daemon in P3Scan 3.0rc1 and earlier versions, which stems from the creation of the p3scan.pid file after the program has downgraded an account to non-root privileges. A...

openSUSE Security Update : the Linux Kernel (openSUSE-2017-1062) (BlueBorne)

The openSUSE Leap 42.2 kernel was updated to 4.4.87 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000251: The native Bluetooth stack in the Linux Kernel BlueZ was vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration...

JVN#16136413: Installers of Sony PaSoRi related software may insecurely load Dynamic Link Libraries

PaSoRi provided by Sony Corporation is contactless IC card reader/writer. Installers of PaSoRi driver and other related software for Windows contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with t...