417 matches found
CVE-2018-14730
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/...
Code injection
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/...
CVE-2018-14730
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/...
CVE-2018-14730
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/...
CVE-2018-14730
The CVE-2018-14730 entry concerns Browserify-HMR. Affected component: the WebSocket server used for Hot Module Replacement. Root cause: origin validation is missing, allowing any origin to receive HMR messages via ws://127.0.0.1:3123/ (or similar), enabling an attacker to access a developer’s cod...
brocode (>=1.0.0, <=2.0.0-pre4), browserify-lazy-server (>=0.0.0-beta.0, <=0.0.0-beta.1) +10 more potentially affected by CVE-2018-14730 via browserify-hmr (0.3.7)
browserify-hmr NPM version 0.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on browserify-hmr and may be impacted: - brocode =1.0.0, =0.0.0-beta.0, =0.2.0, =3.5.0, =1.0.0, =0.0.3, =2.3.0, =0.1.0, =1.0.0, =0.1.0, =0.0.11, =0.0.13 Source cves:...
CVE-2018-14730: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/...
PT-2018-12687
Name of the Vulnerable Software and Affected Versions browserify-hmr versions prior to 0.4.0 Description An issue was discovered where the origin of requests is not checked by the WebSocket server used for Hot Module Replacement HMR, allowing attackers to steal a developer's code. The WebSocket...
Insecure Cryptography
crypto-browserify is generates cryptographically insecure random numbers. The library uses the native JavaScript Math.Random to generate random numbers, that has been proven as not secure...
Potential for Script Injection
Overview Versions of syntax-error prior to 1.1.1 are affected by a cross-site scripting vulnerability which may allow a malicious file to execute code when browserified. Recommendation Update to version 1.1.1 or later. References - Browserify 4.2.1 Update - GitHub Advisory...
Browserify Node.js Remote Code Execution (CVE-2014-7192)
A remote code execution was discovered in Browserify Node.js. An unauthenticated attacker may use this vulnerability to execute code on the vulnerable server...
Node Browserify RCE vuln (<= 4.2.0)
Hello, Discovered an RCE vuln in Browserify =4.2.0. Maintainer patched upstream just 4 hours after responsible disclosure yesterday, now fixed as of 4.2.1. Summary and POC found here: http://iops.io/blog/browserify-rce-vulnerability/ Cal...
Node Browserify 4.2.0 - Remote Code Execution Vulnerability
Exploit for multiple platform in category remote exploits !/usr/bin/python """ Browserify POC exploit http://iops.io/blog/browserify-rce-vulnerability/ To run, just do: $ python poc.py exploit.js $ browserify exploit.js BITCH I TOLD YOU THIS SHIT IS FABULOUS garbage output ,,,1 00:08:32 up 12:29,...
Node Browserify 4.2.0 - Remote Code Execution Vulnerability
No description provided by source. !/usr/bin/python """ Browserify POC exploit http://iops.io/blog/browserify-rce-vulnerability/ To run, just do: $ python poc.py exploit.js $ browserify exploit.js BITCH I TOLD YOU THIS SHIT IS FABULOUS garbage output ,,,1 00:08:32 up 12:29, 3 users, load average:...
Node Browserify 4.2.0 - Remote Code Execution
Node Browserify 4.2.0 - Remote Code Execution !/usr/bin/python """ Browserify POC exploit http://iops.io/blog/browserify-rce-vulnerability/ To run, just do: $ python poc.py exploit.js $ browserify exploit.js BITCH I TOLD YOU THIS SHIT IS FABULOUS garbage output ,,,1 00:08:32 up 12:29, 3 users, lo...
Node Browserify 4.2.0 - Remote Code Execution
!/usr/bin/python """ Browserify POC exploit http://iops.io/blog/browserify-rce-vulnerability/ To run, just do: $ python poc.py exploit.js $ browserify exploit.js BITCH I TOLD YOU THIS SHIT IS FABULOUS garbage output ,,,1 00:08:32 up 12:29, 3 users, load average: 0.00, 0.02, 0.05 uid=1001foxx...
Browserify 4.2.0 Remote Command Execution
!/usr/bin/python """ Browserify POC exploit http://iops.io/blog/browserify-rce-vulnerability/ To run, just do: $ python poc.py exploit.js $ browserify exploit.js BITCH I TOLD YOU THIS SHIT IS FABULOUS garbage output ,,,1 00:08:32 up 12:29, 3 users, load average: 0.00, 0.02, 0.05 uid=1001foxx...