Cross-Site Scripting (XSS)

dompurify is vulnerable to cross-site scripting XSS. A mutation XSS vulnerability exists as a serialize-parse roundtrip does not return the original DOM tree, causing a namespace change from HTML to MathML via FORM elements...

CVE-2020-26870

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

CVE-2020-26870

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

UBUNTU-CVE-2020-26870

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

CVE-2020-26870

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

CVE-2020-26870

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

PT-2020-5443

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.0.17 Description The issue is related to the DOMPurify library and its failure to protect the structure of a web page. This can be exploited by a remote attacker to perform a cross-site scripting attack...

CVE-2020-26870: Improper Neutralization of Input During Web Page Generation

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

Denial Of Service (DoS)

serialize-to-js is vulnerable to denial of service DoS. The vulnerability exists as the unvalidated user input could cause an infinite loop in the deserialize function...

Denial of Service in serialize-to-js

Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely. Recommendation Upgrade to version 2.0.0 or later...

GHSA-W5Q7-3PR9-X44W Denial of Service in serialize-to-js

Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely. Recommendation Upgrade to version 2.0.0 or later...

PT-2020-21541

Name of the Vulnerable Software and Affected Versions serialize-to-js versions prior to 2.0.0 Description The issue is related to a Denial of Service, where user input is not properly validated. This allows attackers to provide inputs that cause the execution to loop indefinitely. Recommendations...

@adobe/helix-testutils (>=0.3.2, <=0.4.0), @agreed/ui (>=5.0.4, <=5.1.6) +56 more potentially affected by CVE-2020-7660 via serialize-javascript (3.0.0)

serialize-javascript NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @adobe/helix-testutils =0.3.2, =5.0.4, =0.1.3-alpha.0, =0.1.19-alpha.0, =0.1.11-alpha.0, =0.1.3-alpha.0,...

@adobe/helix-testutils (>=0.3.2, <=0.4.0), @agreed/ui (>=5.0.4, <=5.1.6) +56 more potentially affected by CVE-2020-7660 via serialize-javascript (3.0.0)

serialize-javascript NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @adobe/helix-testutils =0.3.2, =5.0.4, =0.1.3-alpha.0, =0.1.19-alpha.0, =0.1.11-alpha.0, =0.1.3-alpha.0,...

Insecure serialization leading to RCE in serialize-javascript

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". An object such as "foo": /1"/, "bar": "a"@R--0@" was serialized as "foo": /1"/, "bar": "a/1"/, which allows an attacker to escape the bar key. This requires...

GHSA-HXCC-F52P-WC94 Insecure serialization leading to RCE in serialize-javascript

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". An object such as "foo": /1"/, "bar": "a"@R--0@" was serialized as "foo": /1"/, "bar": "a/1"/, which allows an attacker to escape the bar key. This requires...

npm-serialize-javascript: XSS via unsafe characters in serialized regular expressions

A XSS flaw was found in npm-serialize-javascript. It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString backslash-escapes all forward slashes ...

npm-serialize-javascript: allows remote attackers to inject arbitrary code via the function deleteFunctions within index.js

A flaw was found in the serialize-javascript before version 3.1.0. This flaw allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js."...

OSV-2020-704 Heap-buffer-overflow in BEInt<unsigned char, 1>::set

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13736 Crash type: Heap-buffer-overflow WRITE 1 Crash state: BEInt::set CFF::CFFIndex ::setoffsetat bool CFF::FDArray ::serializeCFF::cff2fontdict...

OSV-2020-580 Heap-buffer-overflow in ots::OpenTypeSTAT::Serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12840 Crash type: Heap-buffer-overflow READ 2 Crash state: ots::OpenTypeSTAT::Serialize ProcessGeneric ProcessTTF...