161132 matches found
Malicious code in chai-as-relay (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line 4.4MB obfuscator.io-packed IIFE hex-escaped...
CVE-2026-100641
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100630
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...
CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
EUVD-2026-87735
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100641
SiYuan versions before v3.8.4 are vulnerable to a Stored XSS flaw because they fail to HTML-escape stored flashcard block content. Specifically, content retrieved from the /api/riff/getRiffCards endpoint is inserted into app/src/card/viewCards.ts and assigned to listElement.innerHTML without prop...
CVE-2026-100641 SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before interpolating it into the card-manager list markup. Block content returned by /api/riff/getRiffCards is inserted into a card item template in app/src/card/viewCards.ts and assigned to listElement.innerHTML, so content...
CVE-2026-100630 AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by...
EUVD-2026-87724
AVideo contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline onclick JavaScript string. Attackers with video upload permission can store HTML entity-encoded payloads that bypass isValidURL validation and are decoded by the browser t...
CVE-2026-100630
AVideo contains a stored cross-site scripting (XSS) vulnerability within the video trailer1 field . The issue arises because this field is rendered unsanitized inside an inline onclick JavaScript string . Attackers who possess video upload permissions can inject HTML entity-encoded payloads that ...
Astra Linux – Vulnerability in Chromium
A heap buffer overflow in the Codecs component of Google Chrome prior to version 151.0.7922.72 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
The use of after-free in Views in Google Chrome before version 152.0.7977.65 allowed a remote attacker to leverage social engineering to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Before version 151.0.7922.109, using the “After Free” feature in Google Chrome extensions allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code within a sandbox through a crafted Chrome extension. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The use of after-free in V8 in Google Chrome before version 153.0.8010.36 allowed a remote attacker to leverage social engineering to execute arbitrary code within the sandbox through a crafted Chrome extension. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
In V8 of Google Chrome, before version 152.0.7977.75, an uninitialized resource allowed a remote attacker to execute arbitrary code within the sandbox through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Before version 152.0.7977.65, using free after in the Chromecast with Google Chrome allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox through a crafted HTML page. Chromium security severity: Critical...
Astra Linux – Vulnerability in Chromium
Before version 151.0.7922.72, using free after in the DOM in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...