860 matches found
CVE-2025-3060 Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005
Vulnerability in Drupal Flattern – Multipurpose Bootstrap Business Profile.This issue affects Flattern – Multipurpose Bootstrap Business Profile:...
UBUNTU-CVE-2025-27832
An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c...
DRUPAL-CORE-2025-004
Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...
DEBIAN-CVE-2025-2123
A vulnerability, which was classified as problematic, has been found in GeSHi up to 1.0.9.1. Affected by this issue is the function getvar of the file /contrib/cssgen.php of the component CSS Handler. The manipulation of the argument...
Malicious code in @idps/contrib-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b812aaf7e12bd61301969890faac8bcd578104dec35d8c53abfd520ab05c4c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-57081
A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
CVE-2024-57081
A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
Prototype Pollution
Overview org.webjars.bower:underscore-contrib is an underscore-contrib ================== Affected versions of this package are vulnerable to Prototype Pollution through the lib.fromQuery function. An attacker can disrupt service by supplying a crafted payload with Object.prototype setter to...
Prototype Pollution
Overview org.webjars.npm:underscore-contrib is an underscore-contrib ================== Affected versions of this package are vulnerable to Prototype Pollution through the lib.fromQuery function. An attacker can disrupt service by supplying a crafted payload with Object.prototype setter to...
org.webjars.npm:catharsis (0.8.9) potentially affected by CVE-2024-57081 via org.webjars.npm:underscore-contrib (0.3.0)
org.webjars.npm:underscore-contrib MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:underscore-contrib and may be impacted: - org.webjars.npm:catharsis 0.8.9 Source cves: CVE-2024-57081 Source advisory:...
underscore-contrib 安全漏洞
underscore-contrib is an open source application from DocumentCloud. A security vulnerability exists in underscore-contrib version v0.3.0, which stems from the lib.fromQuery function containing a prototype contamination vulnerability...
OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013
This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources. The module does not use Cross Site Request Forgery CSRF tokens to protect routes for enabling a client. This vulnerability is mitigated by the fact that an...
CVE-2024-57081
A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
CVE-2024-57081
A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
CVE-2024-57081
underscore-contrib v0.3.0 contains a prototype pollution flaw in the lib.fromQuery function. An attacker can trigger a Denial of Service by supplying a crafted payload that manipulates Object.prototype via the vulnerable path, as demonstrated in multiple sources (including Snyk reports). The core...
CVE-2024-35231
rack-contrib provides contributed rack middleware and utilities for Rack, a Ruby web server interface. Versions of rack-contrib prior to 2.5.0 are vulnerable to denial of service due to the fact that the user controlled data profilerruns was not constrained to any limitation. This would lead to...
Malicious code in grunt-contrib-coffe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 608342fd765a8ca05148b5ba0f5239013fca2a932cd08d7288fc3cba5a068a1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1128 Malicious code in grunt-contrib-coffe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 608342fd765a8ca05148b5ba0f5239013fca2a932cd08d7288fc3cba5a068a1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011
This module enables you to integrate the site with the Google Tag Manager GTM application. The module doesn't have the "restrict access" flag on the "administer googletagcontainer" permission. A user with this permission can load a GTM container that completely changes the page or inserts malicio...