4282 matches found
CVE-2020-24301
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...
CVE-2020-24301
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...
Design/Logic Flaw
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...
CVE-2020-24301
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...
CVE-2020-24301
The CVE-2020-24301 entry concerns the HAPI FHIR Testpage Overlay (v5.0.0 and below) with a cross-site scripting (XSS) vulnerability. Multiple connected sources (e.g., Veracode, Red Hat, NVD, OSV, and GitLab repo artifact) identify that the issue arises from lack of sanitization of the PARAM_RESOU...
CVE-2020-24301
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...
CVE-2020-24301: Improper Neutralization of Input During Web Page Generation
Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testin...
Cross-site Scripting
Users of the HAPI FHIR Testpage Overlay can use a specially crafted URL to exploit an XSS vulnerability in this module, allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low, as this module is intended for testing and not believ...
PT-2020-15675
Name of the Vulnerable Software and Affected Versions HAPI FHIR Testpage Overlay versions 5.0.0 and below Description The issue allows users to exploit an XSS vulnerability using a specially crafted URL, enabling arbitrary JavaScript to be executed in the user's browser. This vulnerability is...
GHSA-RHC3-76JW-4F2X Denial of Service in @commercial/ammo
Versions of @commercial/ammo prior to 2.1.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is...
Denial of Service in @commercial/ammo
Versions of @commercial/ammo prior to 2.1.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is...
@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by unknown CVE via @hapi/hoek (9.0.2)
@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves: unknown CVE...
@pixul/nodemailer-sparkpost (>=3.0.0, <=3.0.3), @pixul/sparkpost (>=3.0.0, <=3.0.1) +7 more potentially affected by unknown CVE via @hapi/hoek (>=8.3.2, <=8.5.0)
@hapi/hoek NPM version =8.3.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =1.8.2, =1.5.0, =2.0.0, =2.0.1 Source cves: unknown CVE Source advisory: GHSA-22H7-7WWG-QMGG...
GHSA-22H7-7WWG-QMGG Prototype Pollution in @hapi/hoek
Versions of @hapi/hoek prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The clone function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which may lead t...
@pixul/nodemailer-sparkpost (>=3.0.0, <=3.0.3), @pixul/sparkpost (>=3.0.0, <=3.0.1) +7 more potentially affected by unknown CVE via @hapi/hoek (>=8.3.2, <=8.5.0)
@hapi/hoek NPM version =8.3.2, =3.0.0, =3.0.0, =1.8.2, =1.8.2, =1.1.1, =2.2.0, =1.8.2, =1.5.0, =2.0.0, =2.0.1 Source cves: unknown CVE Source advisory: OSV:GHSA-22H7-7WWG-QMGG...
Prototype Pollution in @hapi/hoek
Versions of @hapi/hoek prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The clone function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties that exist in all objects, which may lead t...
GHSA-2GGQ-VFCP-GWHJ Cross-Site Scripting in @hapi/boom
Versions of @hapi/boom prior to 0.3.8 are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.3.8 or later...
Cross-Site Scripting in @hapi/boom
Versions of @hapi/boom prior to 0.3.8 are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 0.3.8 or later...
Denial Of Service (DoS)
@hapi/hapi is vulnerable to denial of service. The CORS request handler causes the function to throw a system error if the header contains certain invalid values...
PT-2020-20957
Name of the Vulnerable Software and Affected Versions @hapi/boom versions prior to 0.3.8 Description The issue arises from the package's failure to properly escape error messages, potentially allowing attackers to execute arbitrary JavaScript in a victim's browser. This could lead to Cross-Site...