1047 matches found
CVE-2024-21541
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not...
CVE-2024-21541
Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without complete input sanitization. Function generates a new function body and thus care must be given to ensure that the inputs to Function are not...
PT-2024-18954 · Unknown · Dom-Iterator
Name of the Vulnerable Software and Affected Versions: dom-iterator versions prior to 1.0.1 Description: The issue is related to Arbitrary Code Execution due to the use of the Function constructor without complete input sanitization. This allows an attacker to generate a new function body, posing...
kernel: drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor()
No description is available for this CVE...
CVE-2019-20149
...
CVE-2023-50883
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...
CVE-2023-50883
ONLYOFFICE Docs before 8.0.1 allows XSS because a macro is an immediately-invoked function expression IIFE, and therefore a sandbox escape is possible by directly calling the constructor of the Function object. NOTE: this issue exists because of an incorrect fix for CVE-2021-43446...
Ascensio System ONLYOFFICE 安全漏洞
Ascensio System ONLYOFFICE is an office software from the Latvian company Ascensio System. A security vulnerability exists in Ascensio System ONLYOFFICE versions prior to 8.0.1, which originates from the ability to sandbox escape by directly calling the constructor of a Function object...
CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon
Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...
GHSA-CXGV-PX37-4MP2 Nuxt Icon affected by a Server-Side Request Forgery (SSRF)
Summary nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure...
Nuxt Icon affected by a Server-Side Request Forgery (SSRF)
Summary nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure...
PT-2024-25800 · Unjs/Ufo +1 · Unjs/Ufo +1
Name of the Vulnerable Software and Affected Versions: Nuxt versions prior to 3.12.4 Description: The navigateTo function does not correctly use APIs provided by unjs/ufo, leading to parsing discrepancies. The function first checks if a URL has a protocol using the unjs/ufo package, which works...
PT-2024-40827 · Oracle · Java
Name of the Vulnerable Software and Affected Versions: Java affected versions not specified Description: A security exception crash has been reported. The crash involves the com.github.javaparser.GeneratedJavaParser.Expression and java.base/java.lang.StringUTF16.compress functions, as well as the...
Malicious code in EmptуConstructor.Fоdy (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in EmрtуConstruсtor.Fоdy (NuGet)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @epgu/epgu-constructor-types (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2308 Malicious code in @epgu/epgu-constructor-types (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @epgu/epgu-constructor (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2307 Malicious code in @epgu/epgu-constructor (npm)
--- -= Per source details. Do not edit below this line.=-...
UBUNTU-CVE-2024-38582
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential hang in nilfsdetachlogwriter Syzbot has reported a potential hang in nilfsdetachlogwriter called during nilfs2 unmount. Analysis revealed that this is because nilfssegctorsync, which synchronizes with the lo...