Malicious code in @facetca/facet-mmleditor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3afa70fa6de6ec83d479072d976210414be16f6e5f35019f8aadd2e0c6c4ec91 The OpenSSF Package Analysis project identified '@facetca/facet-mmleditor' @ 3.0.3 npm as malicious. It is considered malicious because: - The...

CVE-2024-31984 XWiki Platform: Remote code execution through space title and Solr space facet

XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the Solr-based search in XWiki. This allows any user who can edi...

Cross-site Scripting (XSS)

com.liferay.portal.search.web is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the modified facet widget, which allows an attacker to inject and execute malicious web script or HTML via a crafted payload through the facet label...

CVE-2023-33939

Cross-site scripting XSS vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted...

CVE-2023-33939

Cross-site scripting XSS vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbitrary web script or HTML via a crafted...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP ...

PT-2023-24580

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.1.0 through 7.4.3.12 Liferay DXP versions 7.1.0 through 7.1 before fix pack 27 Liferay DXP versions 7.2.0 through 7.2 before fix pack 18 Liferay DXP versions 7.3.0 through 7.3 before update 4 Liferay DXP versions 7.4....

Vulnerability of SNC_io_parser<EW>::read_facet(): Allows attackers to access confidential data, compromise its integrity, and cause service failures. This vulnerability resides in the SEdge_of component of the Nef_S2/SNC_io_parser.h library, which is part of the Computational Geometry Algorithms library.

Vulnerability of SNCio parser ::readfacet: Reads boundaryentryobjects from SEdgeof component NefS2/SNCio parser.h in the computational geometry algorithm library. This vulnerability involves reading data beyond the allowed buffer boundaries. Exploitation of this vulnerability allows an attacker t...

Vulnerability of SNC_io_parser<EW>::read_facet(): Allows attackers to access confidential data, compromise its integrity, and cause service failures. This vulnerability exists in the SNC_io_parser.h library from the Computational Geometry Algorithms library, which is part of the Nef_S2/SNC_io_parser project.

Vulnerability of SNCio parser ::readfacet:fh-boundaryentryobjects in the component SLoopof from the NefS2/SNCio parser.h library, a computational geometry algorithm library, is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential...

Vulnerability of the SNC_io parser function <EW>: read_facet(), fh->twin(). This component is part of the Nef_S2/SNC_io parser.h library. It belongs to the computational geometry algorithm libraries CGAL. It allows an intruder to access confidential data, compromise its integrity, and also cause service failures.

The vulnerability of the SNCioparser function: readfacet, fh-twin in the NefS2/SNCioparser.h component, is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures through a...

Vulnerability of the SNC_io parser function <EW>: read_facet(), incident_volume(). Component: Nef_S2/SNC_io parser.h library, algorithm library for computational geometry CGAL. This allows an intruder to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the SNCio parser function ::readfacet and fh-incidentvolume in the NefS2/SNCio parser component’s NefS2/SNCio parser.h file is related to unvalidated array indexing. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity...

uint16 type for the facet position and selector position

Lines of code Vulnerability details Description In the Diamond library there is uint16 type used for the facet position and selector position in the FacetToSelectors and SelectorToFacet structs. That creates a restriction that the number of facets is limited by 2^16. In case when the number of...

May introduce an invalid Facet into the system

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The saveFacetIfNew has not checked if the newly introduced facet is valid or not a valid contract, therefore, an invalid address might be added as a facet. according to Solidity documentation, "If the...

Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module

In Search Web before v6.0.19 in Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting XSS vulnerability in the Portal Search module's Custom Facet widget. This vulnerabili...

GHSA-7R3W-WGGM-PJWF Liferay Portal and Liferay DXP Vulnerable to XSS in the Portal Search Module

In Search Web before v6.0.19 in Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting XSS vulnerability in the Portal Search module's Custom Facet widget. This vulnerabili...

CVE-2022-28979

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting XSS vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute...

Cross site scripting

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting XSS vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute...

CVE-2022-28979

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting XSS vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute...

CVE-2022-28979

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting XSS vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute...

CVE-2022-28979

Liferay Portal v7.1.0 through v7.4.2 and Liferay DXP 7.1 before fix pack 26, 7.2 before fix pack 15, and 7.3 before service pack 3 was discovered to contain a cross-site scripting XSS vulnerability in the Portal Search module's Custom Facet widget. This vulnerability allows attackers to execute...