407 matches found
CVE-2024-4067 Regular Expression Denial of Service in micromatch
The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability occurs in micromatch.braces in index.js because the pattern . will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the...
CVE-2024-29154
danielmiessler fabric through 1.3.0 allows installer/client/gui/static/js/index.js XSS because of innerHTML mishandling, such as in htmlToPlainText...
CVE-2023-50473
Cross-Site Scripting XSS vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session identifiers SID in index.js file...
CVE-2023-50473
Cross-Site Scripting XSS vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session identifiers SID in index.js file...
Cross site scripting
Cross-Site Scripting XSS vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session identifiers SID in index.js file...
CVE-2023-50473
Cross-Site Scripting XSS vulnerability in bill-ahmed qbit-matUI version 1.16.4, allows remote attackers to obtain sensitive information via fixed session identifiers SID in index.js file...
PT-2023-31574 · Unknown · Bill-Ahmed Qbit-Matui
Name of the Vulnerable Software and Affected Versions: bill-ahmed qbit-matUI version 1.16.4 Description: The issue is a Cross-Site Scripting XSS vulnerability that allows remote attackers to obtain sensitive information via fixed session identifiers SID in the index.js file. This vulnerability...
CVE-2023-50473
CVE-2023-50473 affects bill-ahmed qbit-matUI v1.16.4. The issue is a Cross-Site Scripting (XSS) vulnerability that allows remote attackers to obtain sensitive information via fixed session identifiers (SID) in the index.js file. Connected sources also indicate a remediation path: update to a newe...
CVE-2023-48238
joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens JWT which are a compact URL-safe means of representing claims to be transferred between two parties. Versions prior to 4.0.0 are vulnerable to a JWT algorithm confusion attack. On line 86 of the 'index.js'...
Regular Expression Denial Of Service (ReDoS)
get-func-name is vulnerable to Regular Expression Denial Of Service. The vulnerability is due to the getFuncName function in index.js not properly checking the functionSource size and length. which allows an attacker to trigger a DOS attack by using an input like '\t'.repeat54773 + '\t/function/i...
Denial Of Service (DoS)
nodebb is vulnerable to Denial Of Service. The vulnerability is due to the onMessage function in index.js as there is no validation when passing messages to the eventName.startsWith or eventName.toString methods, which can result in an application crash when the message contains an array or objec...
Path Traversal
m.static is vulnerable to Path Traversal. The vulnerability exists due to the improper path sanitization in the requestFile parameter in the requestListener function of index.js, which allows an attacker to access files outside the expected directory through relative paths...
CVE-2023-26820
siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js...
CVE-2023-26820
siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js...
Path traversal
siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js...
siteproxy 路径遍历漏洞
siteproxy is a reverse proxy for netptop individual developers. A security vulnerability exists in siteproxy v1.0, which stems from a path traversal problem in the component index.js...
CVE-2023-26820
CVE-2023-26820 affects siteproxy v1.0; a path traversal vulnerability exists in the index.js component. The NVD/CNA metrics assign a high impact to confidentiality (C:H) with network access, low attack complexity, and no user interaction. There is no public exploit detail provided in the document...
CVE-2023-26820
siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js...
