Malicious code in masolv-avo-cbv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddb20b60fb713ee3115c1d309201c1ce1fffc3e617cd4769533dcc8afd24f33c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masolv-avo-ucav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9760f79279f02a8a247b4bf2736c14e30ff6d531f73c618d1eb4835ae1c2501a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2024-0353

Malicious code in bioql PyPI...

EUVD-2024-0356

Malicious code in bioql PyPI...

CVE-2024-22411

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A maliciou...

CVE-2023-34103

Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Scripting XSS when rendering html based content. Attackers do need form edit privilege in order to successfully exploit this vulnerability, but the results are...

CVE-2023-34102

Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes...

CVE-2024-22191

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting XSS vulnerability was found in the keyvalue field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the...

Cross Site Scripting (XSS)

avo is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization of text passed in error or succeed messages within the Avo::BaseAction subclass. An attacker can inject arbitrary JavaScript into the message fields resulting in XSS...

Cross-site scripting (XSS) in Action messages on Avo

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A maliciou...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the error or succeed methods in an Avo::BaseAction subclass. An attacker can execute arbitrary scripts in the context of the user's browser session by injecting unsanitized HTML content into toast...

GHSA-G8VP-2V5P-9QFH Cross-site scripting (XSS) in Action messages on Avo

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A maliciou...

Cross Site Scripting (XSS)

avo is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization of the keyvalue parameters within keyvaluecontroller.js. An attacker can inject arbitrary Javascript into the victim's browser...

Cross-site scripting (XSS) in Action messages on Avo

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12 any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious...

CVE-2024-22411

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A maliciou...

CVE-2024-22191

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting XSS vulnerability was found in the keyvalue field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the...

Cross site scripting

Avo is a framework to create admin panels for Ruby on Rails apps. A stored cross-site scripting XSS vulnerability was found in the keyvalue field of Avo v3.2.3 and v2.46.0. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. The value of the...

Cross site scripting

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A maliciou...

CVE-2024-22411

Consolidated finding: CVE-2024-22411 affects the Avo framework for Ruby on Rails. In Avo 3 pre12, HTML content inside text passed to error or succeed in an Avo::BaseAction is rendered un Sanitized in the UI toast/notification, enabling cross-site scripting (XSS). The issue can impact users of Avo...

CVE-2024-22411 Cross site scripting in Action messages on Avo

Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A maliciou...