CLEANSTART-2024-NU92071 When importing resources using Web Workers, error messages would distinguish the difference between <code>application/javascript</code> responses and non-script responses

CVE-2022-22760 affects multiple packages. When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. See references for individual vulnerability details...

CVE-2016-1000233

Affected versions of "swagger-ui" are vulnerable to cross-site scripting. This vulnerability exists because "swagger-ui" automatically executes external Javascript that is loaded in via the "url" query string parameter when a "Content-Type: application/javascript" header is included. An attacker...

CVE-2026-41269

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally...

CVE-2026-41269: Unrestricted Upload of File with Dangerous Type

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the Chatflow configuration file upload settings can be modified to allow the application/javascript MIME type. This lets an attacker upload .js files even though the frontend doesn’t normally...

Mozilla: Cross-origin responses could be distinguished between script and non-script content-types

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn...

Cross site scripting

When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox 97, Thunderbird 91.6, and Firefox ESR 91...

CVE-2021-32770

Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js a...