2566 matches found
CVE-2024-43788
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
CVE-2024-43788
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
UBUNTU-CVE-2024-43788
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
CVE-2024-43788 DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
CVE-2024-43788
CVE-2024-43788: Webpack’s AutoPublicPathRuntimeModule DOM clobbering enables XSS via scriptless HTML (e.g., unsanitized name/id attributes). Real-world exploitation observed in Canvas LMS. Fix is in Webpack release 5.94.0; upgrade recommended (no public workarounds documented).
CVE-2024-43788 DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
CVE-2024-43788 DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
CVE-2024-43788
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
@abdul-kissflow/form-field-scripts (0.0.7), @abo-academy/core (>=0.0.1, <=0.0.2) +1747 more potentially affected by CVE-2024-43788 via webpack (>=5.0.0-alpha.14, <=5.93.0)
webpack NPM version =5.0.0-alpha.14, =0.0.1, =0.0.1, =0.0.1, =0.2.14, =1.6.0, =1.0.0, =3.0.0, =1.0.44, =3.0.0-beta.0, =1.0.0-rc2, =2.0.5-beta.11, =1.0.0-beta.0, =1.2.1-alpha.0 and more Source cves: CVE-2024-43788 Source advisory: MEND:CVE-2024-43788...
CVE-2024-43788
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
CVE-2024-43788: Improper Neutralization of Input During Web Page Generation
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack’s...
PT-2024-30657
Name of the Vulnerable Software and Affected Versions Webpack versions prior to 5.94.0 Description A DOM Clobbering vulnerability has been discovered in Webpack's AutoPublicPathRuntimeModule. This vulnerability can lead to cross-site scripting XSS in web pages where scriptless attacker-controlled...
Webpack security vulnerabilities
Webpack is a module packer from the Webpack open source. Its primary purpose is to bundle JavaScript files for use in the browser, but it is also capable of converting, bundling, or packaging almost any resource or asset. Webpack has a security vulnerability that stems from the inclusion of a...
Important: Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 2.6.1 GA ]
An update to the images for Red Hat build of Apicurio Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of...
webpack-dev-middleware: lack of URL validation may lead to file leak
A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling...
Important: Red Hat Security Advisory: Red Hat Data Grid 8.5.0 security update
An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...
webpack-dev-middleware: lack of URL validation may lead to file leak
A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling...
ROS-20240704-07
A vulnerability in the parseQuery function of the Webpack loader-utilss package is related to improperly controlled modification of object characteristic attributes. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary JavaScript code Ansi-regex ANSI...
@aofl/cli (>=4.0.0-alpha.0, <=4.0.0-alpha.45), @aofl/html-webpack-purify-internal-css-plugin (>=4.0.0-alpha.22, <=4.0.0-alpha.45) +4 more potentially affected by CVE-2024-38987 via @aofl/cli-lib (4.0.0-alpha.45)
@aofl/cli-lib NPM version 4.0.0-alpha.45 is affected by a known vulnerability. The following packages have a transitive dependency on @aofl/cli-lib and may be impacted: - @aofl/cli =4.0.0-alpha.0, =4.0.0-alpha.22, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.45...