@appsocially/timepassport (>=0.1.2-0.1, <=0.1.29), @becompliancebr/shared-components (>=1.0.0, <=1.10.0) +80 more potentially affected by CVE-2022-25873 via vuetify (>=2.0.0, <=2.6.9)

vuetify NPM version =2.0.0, =0.1.2-0.1, =1.0.0, =1.2.5-1, =5.0.1-beta.0, =0.0.128-beta.33, =0.0.101-beta.22, =0.0.132-alpha.448, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.132-alpha.448, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.132-beta.446 and more Source cves:...

SQL injection in pagekit/pagekit

Pagekit is a modular and lightweight CMS built with Symfony components and Vue.js. The configAction in SettingsController allow user to set the order of comments listing. The allowed options are ASC and DESC. That config then get concatenated directly to the SQL query. Due to the fact that there...

GHSA-45HC-R4FJ-QJ89 SQL injection in pagekit/pagekit

Pagekit is a modular and lightweight CMS built with Symfony components and Vue.js. The configAction in SettingsController allow user to set the order of comments listing. The allowed options are ASC and DESC. That config then get concatenated directly to the SQL query. Due to the fact that there...

Dev Sabotages Popular NPM Package to Protest Russian Invasion

The developer behind the hugely popular npm package “node-ipc” has released sabotaged versions of the library to condemn Russia’s invasion of Ukraine: a supply-chain tinkering that he’d prefer to call “protestware” as opposed to “malware.” Regardless of the peace-not-war messaging, node-ipc is no...

Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

Description In order to render raw HTML in Vue.js you may use v-html attribute, which opens a door for XSS in case of malicious input. Chatwoot actually uses it in several places, such as...

ZEIT Next.js 输入验证错误漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. ZEIT Next.js suffers from an input validation error vulnerability that stems from the software's lack of effective handling of incorrectly formatted urls. An invalid or incorrectly...

WordPress Plugin uListing Cross-Site Request Forgery Vulnerability (CNVD-2022-06499)

The WordPress plugin uListing is a directory and listing plugin based on Vue.js. The WordPress plugin uListing 2.0.5 and earlier versions are vulnerable to cross-site request forgery. An attacker could exploit the vulnerability to update settings...

WordPress plugin uListing SQL injection vulnerability

The WordPress plugin uListing is a directory and listing plugin based on Vue.js. A SQL injection vulnerability exists in the custom parameter of the WordPress plugin uListing 2.0.3 and earlier versions. No details of the vulnerability are currently available...

WordPress plugin uListing permission elevation vulnerability

WordPress plugin uListing is a directory and listing plugin based on Vue.js. WordPress plugin uListing 2.0.5 and earlier versions are vulnerable to an elevation of privilege vulnerability. No details of the vulnerability are currently available...

WordPress plugin uListing cross-site request forgery vulnerability

The WordPress plugin uListing is a directory and listing plugin based on Vue.js. The WordPress plugin uListing 2.0.5 and earlier versions are vulnerable to cross-site request forgery. An attacker could exploit the vulnerability to modify user roles...

WordPress plugin uListing reflective cross-site scripting vulnerability

WordPress plugin uListing is a directory and listing plugin based on Vue.js. WordPress plugin uListing in version 2.0.5 and earlier...

WordPress Plugin uListing Cross-Site Request Forgery Vulnerability (CNVD-2022-06502)

The WordPress plugin uListing is a directory and listing plugin based on Vue.js. A cross-site request forgery CSRF vulnerability exists in WordPress plugin uListing 2.0.5 and earlier versions. The vulnerability stems from a lack of CSRF checks on the plugin's admin page. No detailed vulnerability...

WordPress 插件 跨站脚本漏洞

WordPress plugin uListing is a directory and listing plugin based on Vue.js. WordPress plugin uListing 2.0.5 and earlier versions are vulnerable to an insecure direct object reference vulnerability. No detailed vulnerability details are currently available...

GHSA-VVF2-PPJ9-PP49 Inefficient Regular Expression Complexity in vuelidate

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS regular expression denial of service flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the urlinput function may cause an application to consume an...

Inefficient Regular Expression Complexity in vuelidate

vuelidate is a simple, lightweight model-based validation for Vue.js 2.x & 3.0. A ReDoS regular expression denial of service flaw was found in the @vuelidate/validators package. An attacker that is able to provide crafted input to the urlinput function may cause an application to consume an...

ZEIT Next.js Input Validation Error Vulnerability (CNVD-2021-61800)

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack, and Babel.js. ZEIT Next.js is vulnerable to an input validation error in versions prior to 11.1.0, which stems from a web system or product that does not properly validate input data. An attacker...

PatrowlHears - PatrowlHears - Vulnerability Intelligence Center / Exploits

PatrOwl provides scalable, free and open-source solutions for orchestrating Security Operations and providing Threat Intelligence feeds. PatrowlHears is an advanced and real-time Vulnerability Intelligence platform, including CVE, exploits and threats news. Try it now! To try PatrowlHears, instal...

@chris-sorrells/snowflakes (1.0.0), @haukeland-mgm/plateviewer (1.0.2) +25 more potentially affected by unknown CVE via buefy (>=0.3.2, <=0.7.1)

buefy NPM version =0.3.2, =0.1.47, =0.0.1, =1.2.0, =3.2.160, =1.0.13, =1.0.0, =1.0.0, =0.6.0, =1.0.1, =1.0.0, =0.0.2, =0.0.1, =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XWQW-RF2Q-XMHF...

Node.js third-party modules: Trojan:JS/CoinMiner in npm files

Hello, I am a front end developer and use Vue.js and Visual Studio Code and have had an issue recently with scripts not running in my terminal so decided to fault find. All programmes that I can think of are up to date, and today I decided to do a full windows defender scan and found the above...

Laravel: Persistent Cross-Site Scripting in default Laravel installation

Persistent XSS in default Laravel Installation I have been using the Laravel framework for quite a while now and discovered something odd. When following the installation instructions for the latest Laravel version 5.6.8 at the time of writing you will be up and running in a matter of minutes. Ev...