203 matches found
CVE-2025-13353 gokey allows secret recovery from a seed file without the master password
In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...
CVE-2025-13353
The CVE-2025-13353 issue affects gokey versions prior to 0.2.0, where a flaw in the seed decryption logic caused passwords/secrets derived from a seed file to be generated from only 28 bytes of entropy (instead of using the full seed, 240 bytes). This allowed a malicious actor with just the seed ...
CVE-2025-64501
Summary: CVE-2025-64501 affects the ProsemirrorToHtml gem used to convert ProseMirror JSON to HTML. In versions 0.2.0 and earlier, it is vulnerable to Cross-Site Scripting (XSS) through malicious HTML attribute values because attribute values aren’t escaped, while tag content is. Impact applies t...
CVE-2025-64501 ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values
ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the prosemirrortohtml gem is vulnerable to Cross-Site Scripting XSS attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values...
EUVD-2025-50824
ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the prosemirrortohtml gem is vulnerable to Cross-Site Scripting XSS attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values...
PT-2025-46205
Name of the Vulnerable Software and Affected Versions ProsemirrorToHtml versions 0.2.0 and below Description The prosemirror to html gem contains a flaw that allows for Cross-Site Scripting XSS attacks. This is due to improper handling of HTML attribute values during the conversion of...
ProsemirrorToHtml 跨站脚本漏洞
ProsemirrorToHtml is an open source HTML code conversion tool from Etamin Studio. A cross-site scripting vulnerability exists in ProsemirrorToHtml 0.2.0 and earlier versions, which stems from not properly escaping HTML attribute values and could lead to cross-site scripting attacks...
Missing Authentication for Critical Function
Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the /api/v1/secret, and /api/v1/service endpoints. An attacker can retrieve sensitive cluster information by sending unauthenticated requests directly to exposed API paths. Workaround Thi...
PT-2025-43651
Name of the Vulnerable Software and Affected Versions Karmada Dashboard versions prior to 0.2.0 Description The Karmada Dashboard, a web-based control panel for the Karmada multi-cluster management project, contains an authentication bypass. Backend API endpoints, such as /api/v1/secret and...
EUVD-2019-0677
Malware in sbrugna...
EUVD-2023-3316
Malicious code in bioql PyPI...
EUVD-2021-34681
Malicious code in bioql PyPI...
EUVD-2022-7447
Malicious code in bioql PyPI...
EUVD-2021-8646
Malicious code in bioql PyPI...
EUVD-2022-3007
Malicious code in bioql PyPI...
EUVD-2023-2491
Malicious code in bioql PyPI...
EUVD-2022-0403
Malicious code in bioql PyPI...
CVE-2025-57323
mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp.addEventHandler function of mpregular version 0.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload,...
CVE-2025-57323
mpregular is a package that provides a small program development framework based on RegularJS. A Prototype Pollution vulnerability in the mp.addEventHandler function of mpregular version 0.2.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload,...
Regularjs 安全漏洞
Regularjs is a js library for creating data-driven components from the regularjs open source. A security vulnerability exists in Regularjs version 0.2.0 and earlier, which stems from a prototype contamination in the mp.addEventHandler function that could lead to a denial of service attack...