MAL-2024-9531 Malicious code in builder-vite (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in builder-vite (npm)

--- -= Per source details. Do not edit below this line.=-...

GHSA-J827-6RGF-9629 Layui has DOM Clobbering gadgets that leads to Cross-site Scripting

Summary A DOM Clobbering vulnerability has been discovered in layui that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., img tags with unsanitized name attributes are present. It's worth noting that we’ve identifed similar issues in other popular...

Layui has DOM Clobbering gadgets that leads to Cross-site Scripting

Summary A DOM Clobbering vulnerability has been discovered in layui that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., img tags with unsanitized name attributes are present. It's worth noting that we’ve identifed similar issues in other popular...

GHSA-GCX4-MW62-G8WM vulnerabilities

Vulnerabilities for packages: vite...

GHSA-GCX4-MW62-G8WM vulnerabilities

Vulnerabilities for packages: vite...

CVE-2024-47068 vulnerabilities

Vulnerabilities for packages: vite...

CVE-2024-47068 vulnerabilities

Vulnerabilities for packages: vite...

Cross Site Scripting(XSS)

Vite is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to improper handling of the document.currentScript lookup in Vite's script imports for cjs, iife, or umd output formats. It allows attackers to manipulate DOM elements, such as using unsanitized attributes in HTML tags, to...

CVE-2024-45812

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

CVE-2024-45812 vulnerabilities

Vulnerabilities for packages: vite...

CVE-2024-45812 vulnerabilities

Vulnerabilities for packages: vite...

CVE-2024-45811

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...

CVE-2024-45811 vulnerabilities

Vulnerabilities for packages: vite...

CVE-2024-45811 vulnerabilities

Vulnerabilities for packages: vite...

CVE-2024-45812 DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

CVE-2024-45812

Vite fixed a DOM Clobbering/XSS in certain build outputs. Affected: Vite bundling with output formats cjs, iife, or umd where document.currentScript is used to resolve VITE_ASSET URLs; an attacker could shadow currentScript via the named DOM tree to swap the script tag with malicious HTML and loa...

CVE-2024-45812 DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

CVE-2024-45812 DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

CVE-2024-45811 server.fs.deny bypassed when using ?import&raw in vite

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...