CVE-2024-47068

A flaw was found in the Rollup module bundler for JavaScript. Certain versions are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta such as import.meta.url in the cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting XS...

CVE-2024-47068

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from "import.meta" e.g., "import.meta.url" in "cjs"/"umd"/"iife" format. The DOM Clobbering gadget can lead to cross-site...

CVE-2024-47068 DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta e.g., import.meta.url in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting...

CVE-2024-47068: Improper Neutralization of Input During Web Page Generation

Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from import.meta e.g., import.meta.url in cjs/umd/iife format. The DOM Clobbering gadget can lead to cross-site scripting...

CVE-2024-45812

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

CVE-2024-45812

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to "cjs"/"iife"/"umd" output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where...

CVE-2024-45812: Improper Neutralization of Input During Web Page Generation

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

PT-2024-31793 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 3.2.11 Vite versions prior to 4.5.5 Vite versions prior to 5.2.14 Vite versions prior to 5.3.6 Vite versions prior to 5.4.6 Description: A DOM Clobbering vulnerability was discovered in Vite when building scripts to...

Malicious code in query-string-cjs (npm)

--- -= Per source details. Do not edit below this line.=-...

bedrock-protocol (>=3.5.0, <=3.5.1), certnode (0.0.1) +3 more potentially affected by CVE-2024-28176 via jose-node-cjs-runtime (>=3.18.0, <=4.10.0)

jose-node-cjs-runtime NPM version =3.18.0, =3.5.0, =2.0.7, =0.0.1, =1.0.0, =1.1.1 Source cves: CVE-2024-28176 Source advisory: MEND:CVE-2024-28176...

cortex-cli (>=2.0.8, <=2.1.1) potentially affected by CVE-2024-28176 via jose-node-cjs-runtime (>=4.6.0, <=4.10.0)

jose-node-cjs-runtime NPM version =4.6.0, =2.0.8, =2.1.1 Source cves: CVE-2024-28176 Source advisory: OSV:GHSA-HHHV-Q57G-882Q...

cortex-cli (>=2.0.8, <=2.1.1) potentially affected by CVE-2024-28176 via jose-node-cjs-runtime (>=4.6.0, <=4.10.0)

jose-node-cjs-runtime NPM version =4.6.0, =2.0.8, =2.1.1 Source cves: CVE-2024-28176 Source advisory: GHSA-HHHV-Q57G-882Q...

ses-cjs (>=1.0.0, <=1.0.1) potentially affected by CVE-2023-39532 via ses (0.13.1)

ses NPM version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on ses and may be impacted: - ses-cjs =1.0.0, =1.0.1 Source cves: CVE-2023-39532 Source advisory: GHSA-9C4H-3F7H-322R...

ses-cjs (>=1.0.0, <=1.0.1) potentially affected by CVE-2023-39532 via ses (0.13.1)

ses NPM version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on ses and may be impacted: - ses-cjs =1.0.0, =1.0.1 Source cves: CVE-2023-39532 Source advisory: OSV:GHSA-9C4H-3F7H-322R...

ses-cjs (>=1.0.0, <=1.0.1) potentially affected by CVE-2023-39532 via ses (0.13.1)

ses NPM version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on ses and may be impacted: - ses-cjs =1.0.0, =1.0.1 Source cves: CVE-2023-39532 Source advisory: MEND:CVE-2023-39532...

MAL-2023-168 Malicious code in chalk-animate-cjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 516c8dd53eb3c24c892eed50063a6f315dc748a4d2f006d392d7ec6785802d0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chalk-animate-cjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 516c8dd53eb3c24c892eed50063a6f315dc748a4d2f006d392d7ec6785802d0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview query-string-cjs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

cortex-cli (2.0.7) potentially affected by CVE-2022-36083 via jose-node-cjs-runtime (3.18.0)

jose-node-cjs-runtime NPM version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on jose-node-cjs-runtime and may be impacted: - cortex-cli 2.0.7 Source cves: CVE-2022-36083 Source advisory: GHSA-JV3G-J58F-9MQ9...

cortex-cli (2.0.7) potentially affected by CVE-2022-36083 via jose-node-cjs-runtime (3.18.0)

jose-node-cjs-runtime NPM version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on jose-node-cjs-runtime and may be impacted: - cortex-cli 2.0.7 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...