CVE-2022-0971

Use after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page...

GHSA-MXVC-FWGX-J778 Whoogle Search Cross-site Scripting via string parameter

The package whoogle-search before version 0.7.2 is vulnerable to Cross-site Scripting XSS via the query string parameter q. In the case where it does not contain the http string, it is used to build the errormessage that is then rendered in the error.html template, using the flask.rendertemplate...

PT-2022-7520 · Webkitgtk +6 · Webkitgtk +6

Name of the Vulnerable Software and Affected Versions: WebKitGTK versions prior to 2.36.8 Description: A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags allows attackers to execute code remotely. This issue is related to the rendering of web pages and can be...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-31127 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-31127 Source advisory: OSV:GHSA-PGJX-7F9G-9463...

Remote Code Execution (RCE)

Overview eta is a Lightweight, fast, and powerful embedded JS template engine Affected versions of this package are vulnerable to Remote Code Execution RCE by overwriting template engine configuration variables with view options received from The Express render API. Note: This is exploitable only...

Malicious Package

Overview schema-render is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Note: This malicious package was uncovered by one of...

Malicious code in @blockpro/render (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0a1f7bd81ab8adb76301077c7c586699a72c2ece1c42f8a97e15f14c1fd1072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-125 Malicious code in @blockpro/render (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0a1f7bd81ab8adb76301077c7c586699a72c2ece1c42f8a97e15f14c1fd1072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in swift-docc-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a748548471b692a94eca43cc0901dbd088779b2299a9f19990ba0709de837502 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6375 Malicious code in swift-docc-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a748548471b692a94eca43cc0901dbd088779b2299a9f19990ba0709de837502 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in schema-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0626f8c6634d26e8d8dfc4b08b2393fbbbeeea2885c7a2bb08be05c835682c0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5964 Malicious code in schema-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0626f8c6634d26e8d8dfc4b08b2393fbbbeeea2885c7a2bb08be05c835682c0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-34000

libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init in renderpipeline/lowmemoryrenderpipeline.cc...

Design/Logic Flaw

libjxl 0.6.1 has an assertion failure in LowMemoryRenderPipeline::Init in renderpipeline/lowmemoryrenderpipeline.cc...

CVE-2022-31403

ITOP v3.0.1 was discovered to contain a cross-site scripting XSS vulnerability via /itop/pages/ajax.render.php...

PT-2022-20733 · Itop +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: ITOP version 3.0.1 Description: A cross-site scripting XSS issue was found in ITOP. The vulnerability can be exploited via the "/itop/pages/ajax.render.php" API endpoint. Recommendations: For ITOP version 3.0.1, as a temporary workaround,...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-29214 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-29214 Source advisory: OSV:GHSA-Q2MX-J4X2-2H74...

GHSA-X43G-GJ9X-838X PhantomJS Arbitrary File Read

PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HT...

Malicious code in com.unity.render-pipelines.high-definition-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c67f837ca8ea83c83003168af81c90f02e07a73994e832484930baf383acb5b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2101 Malicious code in com.unity.render-pipelines.high-definition-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c67f837ca8ea83c83003168af81c90f02e07a73994e832484930baf383acb5b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...