3057 matches found
MAL-2024-9804 Malicious code in rollup-linux-x64-gnu (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9803 Malicious code in rollup-darwin-x64 (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in rollup-darwin-x64 (npm)
--- -= Per source details. Do not edit below this line.=-...
Azure File Sync Agent v19.1 Release – August 2024 (KB5040924)
Update Rollup for Azure File Sync agent version 19.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
2024-10 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 R2 for x64 (KB5044097)
A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...
Azure File Sync Agent v19.1 Release – August 2024 (KB5040924)
Update Rollup for Azure File Sync agent version 19.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
October 8, 2024—KB5044356 (Monthly Rollup)
None None...
October 8, 2024—KB5044320 (Monthly Rollup)
None None...
October 8, 2024-Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 (KB5044096)
None None...
DOM Clobbering
Rollup is vulnerable to a DOM Clobbering. The vulnerability is due to improper handling of import.meta properties in cjs/umd/iife formats, which allows an attacker to perform cross-site scripting XSS attacks through unsanitized HTML elements, like an img tag with an unsanitized name attribute...
1k-tasks (>=4.0.0, <=4.2.2), @adobe/helix-deploy (>=9.3.8, <=9.6.1) +227 more potentially affected by CVE-2024-47068 via rollup (>=4.0.2, <=4.22.2)
rollup NPM version =4.0.2, =4.0.0, =9.3.8, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =0.0.0, =2.17.15, =1.9.12, =18.1.0-rc.1, =18.1.0-rc.1, =10.0.0-alpha.0, =10.0.0-alpha.0, =13.0.0 and more Source cves: CVE-2024-47068 Source advisory: OSV:GHSA-GCX4-MW62-G8WM...
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Summary We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting XSS in web pages where scriptless...
GHSA-GCX4-MW62-G8WM DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Summary We discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use import.meta.url or with plugins that emit and reference asset files from code in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting XSS in web pages where scriptless...
0.2-ui (0.0.1), 1k-tasks (>=2.3.0, <=3.0.2) +2349 more potentially affected by CVE-2024-47068 via rollup (>=2.0.0, <=2.79.1)
rollup NPM version =2.0.0, =2.3.0, =1.0.17, =1.0.0-canary.1, =1.0.0, =0.0.10, =0.0.3, =1.0.1, =1.0.12, =1.0.0, =0.0.4, =3.1.0-next.7, =3.1.0-next.7, =3.1.0-rc.2 and more Source cves: CVE-2024-47068 Source advisory: OSV:GHSA-GCX4-MW62-G8WM...
10-javascriptlib (1.0.0), 1k-tasks (>=3.1.0, <=3.6.1) +391 more potentially affected by CVE-2024-47068 via rollup (>=3.0.0, <=3.29.4)
rollup NPM version =3.0.0, =3.1.0, =9.0.19, =0.0.2, =4.0.0-alpha.2, =0.6.0, =12.0.0, =0.0.3, =0.1.0, =0.0.4, =3.0.1-canary.8, =3.0.1-canary.12 - @clairview/api 23.1.0 and more Source cves: CVE-2024-47068 Source advisory: OSV:GHSA-GCX4-MW62-G8WM...
CVE-2024-47068
A flaw was found in the Rollup module bundler for JavaScript. Certain versions are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta such as import.meta.url in the cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting XS...
DEBIAN-CVE-2024-47068
Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta e.g., import.meta.url in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting...
CVE-2024-47068
Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta e.g., import.meta.url in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting...
UBUNTU-CVE-2024-47068
Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta e.g., import.meta.url in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting...
CVE-2024-47068
CVE-2024-47068 describes a DOM Clobbering vulnerability in Rollup, where bundling scripts using properties from import.meta (eg. import.meta.url) in formats like cjs/umd/iife can trigger XSS via attacker-controlled, scriptless HTML elements. Affected versions are Rollup < 2.79.2, < 3.29.5, ...