pdfjs-vuln-demo

PDF.js 脆弱性デモプロジェクト このプロジェクトは、CVE-2024-4367 で報告された PDF.js pdfjs-dist ライブラリの脆弱性を悪用する概念実証 PoC として提供されています。 実行方法 このリポジトリをフォークしてクローン npm install npm run dev テスト手順 まず http://localhost:4321/ にアクセス テストしたいフロントエンドフレームワークのコンポーネント react、vue、svelte を、対応するカードをクリックして選択 サンプル PDF 脆弱性を悪用していないもの が読み込まれることを確認 すべてのサン...

pdfjs-vuln-demo

PDF.js 脆弱性デモプロジェクト このプロジェクトは、CVE-2024-4367 で報告された PDF.js pdfjs-dist ライブラリの脆弱性を悪用する実証 Proof of Concept として意図されています。 実行までの手順 このリポジトリをフォークしてクローンする npm install npm run dev テスト方法 まず http://localhost:4321/ にアクセスする テストしたいフロントエンドフレームワークのコンポーネント react, vue, svelte を、対応するカードをクリックして選択する...

@cdmx/wappler_ag_grid (>=1.2.5, <=1.7.8), @cosmotech/ui (>=8.0.0, <=9.0.0) +20 more potentially affected by CVE-2024-39001 via ag-grid-community (>=31.0.0, <=31.3.2)

ag-grid-community NPM version =31.0.0, =1.2.5, =8.0.0, =24.6.0-rc.1, =3.6.2-beta.9, =2.7.9, =31.0.0, =31.1.0, =31.0.0, =31.0.0, =31.0.0, =31.0.0, =31.0.0, =0.1.65, =0.1.72 and more Source cves: CVE-2024-39001 Source advisory: OSV:GHSA-328P-362G-R48J...

CVE-2024-23331

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

Design/Logic Flaw

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transforme...

CVE-2023-25572 React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`

react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and usi...

Malicious code in frontend-framework-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3249f5205a1b92d8e4fa170c1209732d6d43bcf2a5b6681aa3176e38a4c358cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3221 Malicious code in frontend-framework-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3249f5205a1b92d8e4fa170c1209732d6d43bcf2a5b6681aa3176e38a4c358cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@ajoursystem/arnisp-bootstrap-xlgrid (1.0.0), @arivazhagan/demo-project (1.0.1) +453 more potentially affected by CVE-2018-14040 via bootstrap (>=3.1.1, <=3.3.7)

bootstrap NPM version =3.1.1, =1.31.0-SNAPSHOT, =0.0.1, =0.0.1, =4.0.8, =1.0.0, =1.0.0, =0.0.0, =0.0.2 and more Source cves: CVE-2018-14040 Source advisory: OSV:GHSA-3WQF-4X89-9G79...

XSS Vulnerability in Heybbs Micro Community

Heybbs micro-community is a front-end based on bootstrap + jq + css, back-end php + mysql development of micro-community program. Heybbs Micro Community has an XSS vulnerability that can be exploited by attackers to obtain administrator cookies...

Sitadel - Web Application Security Scanner

Sitadel is basically an update for WAScan making it compatible for python = 3.4 It allows more flexibility for you to write new modules and implement new features : Frontend framework detection Content Delivery Network detection Define Risk Level to allow for scans Plugin system Docker image...