CVE-2021-33437: Missing Release of Memory after Effective Lifetime

An issue was discovered in mjs mJS: Restricted JavaScript engine, ES6 JavaScript version 6. There are memory leaks in frozencb in mjs.c...

CVE-2021-33438: Out-of-bounds Write

An issue was discovered in mjs mJS: Restricted JavaScript engine, ES6 JavaScript version 6. There is stack buffer overflow in jsonparsearray in mjs.c...

Malicious code in node-es6-seed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28d7306399dc8e5ffc0f9af242283015bb832e1a786c85b39298f738e788a56e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4885 Malicious code in node-es6-seed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28d7306399dc8e5ffc0f9af242283015bb832e1a786c85b39298f738e788a56e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in roblox-es6-migration-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e6744d30670c11b6c78c162fbf812373252b628ed5af3977d02003b1d7711c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

101 (>=0.2.0, <=1.6.2), 101-es6 (0.8.0) +306 more potentially affected by CVE-2021-25943 via 101 (>=1.2.0, <=1.6.3)

101 NPM version =1.2.0, =0.2.0, =0.1.0, =0.0.0, =0.0.2, =2.13.1, =0.0.1, =0.0.2, =0.1.0, =1.0.0, =1.1.2, =0.0.1, =1.0.0, =0.0.48, =0.0.62 and more Source cves: CVE-2021-25943 Source advisory: OSV:GHSA-CWCX-RXGC-CMW3...

Regular Expression Denial of Service (ReDoS) in es6-crawler-detect

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...

GHSA-JXG6-FHWC-9V9C Regular Expression Denial of Service (ReDoS) in es6-crawler-detect

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...

CVE-2020-28501

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...

CVE-2020-28501 Regular Expression Denial of Service (ReDoS)

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...

CVE-2020-28501

The CVE-2020-28501 issue affects es6-crawler-detect prior to 3.1.3. The root cause is a lack of length limitation on the user agent string when fed to regex operators, producing Regular Expression Denial of Service (ReDoS). Reported references from GHSA (Regular Expression Denial of Service in es...

CVE-2020-28501

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...

CVE-2020-28501: Undefined Security Weakness

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...

PT-2021-11556

Name of the Vulnerable Software and Affected Versions: es6-crawler-detect versions prior to 3.1.3 Description: The issue arises from the lack of limitation on the length of user agent strings supplied to regex operators. This can lead to potential problems when processing user agent strings of...

Regular Expression Denial of Service (ReDoS)

Overview es6-crawler-detect is an ES6 version of the original PHP class @CrawlerDetect, it helps you detect bots/crawlers and spiders only by scanning the user-agent string or from the global request.headers. Affected versions of this package are vulnerable to Regular Expression Denial of Service...

Cloudflare: // (double slash) inside es6 template literals interpreted as an inline comment by the auto-minifier

The following is valid javascript: var a = //; So is this: var url = https://hackerone.com; However, Cloudflare's auto-minifier removes the parts of both lines including and after the //, meaning in production, they look like this: var a = var url = https: This can either straight up break or...

Three roads lead to Rome-vulnerability warning-the black bar safety net

In the past two years has been focused on the browser aspect of the research, mainly in the Fuzz-based, fuzzing in the user state of vulnerability discovery, whether it is a vulnerability in quality or CVE outputs have been good results. Until some big players involved, as well as a large number ...

That's so fetch!

There's been some confusion around the new fetch API recently. Let's clear things up. The first thing you'll notice about fetch is it's a massive improvement on XMLHttpRequest in terms of API design. Here's how to get some JSON using XHR: var xhr = new XMLHttpRequest; xhr.open'GET', url;...

Iterators gonna iterate

ES6 gives us a new way to iterate, and it's already supported in stable releases of Firefox, Chrome, & Opera. Here it is: for var num of 1, 2, 3 console.lognum; // Result: 1 // Result: 2 // Result: 3 Unlike for part in thing which iterates through property names of an object in a generic way, for...