CVE-2023-26106

All versions of the package dot-lens are vulnerable to Prototype Pollution via the set function in index.js file...

CVE-2023-26106

CVE-2023-26106 (dot-lens) : Multiple connected sources confirm a Prototype Pollution flaw via the set() function in index.js, affecting all versions of the dot-lens package. Root cause: prototype contamination through set(), enabling unexpected modifications to objects. Reported impact is high (C...

CVE-2023-26106

All versions of the package dot-lens are vulnerable to Prototype Pollution via the set function in index.js file...

PT-2023-20493 · Dot-Lens · Dot-Lens

Name of the Vulnerable Software and Affected Versions: dot-lens versions all Description: The issue concerns Prototype Pollution via the set function in the index.js file. This affects all versions of the dot-lens package. There is no information provided about the estimated number of potentially...

CVE-2023-26106: Improperly Controlled Modification of Object Prototype Attributes

All versions of the package dot-lens are vulnerable to Prototype Pollution via the set function in index.js file...

ECDH Private Key Disclosure

ecdh is vulnerable to ECDH Private Key Disclosure. The vulnerability exists because the deriveSharedSecret function in index.js does not properly check if a point is on the curve, allowing an attacker to retrieve the derived shared secret...

CVE-2023-24251

WangEditor v5 was discovered to contain a cross-site scripting XSS vulnerability via the component /dist/index.js...

CVE-2023-24251

WangEditor v5 was discovered to contain a cross-site scripting XSS vulnerability via the component /dist/index.js...

CVE-2023-24251

WangEditor v5 was discovered to contain a cross-site scripting XSS vulnerability via the component /dist/index.js...

CVE-2023-24251: Improper Neutralization of Input During Web Page Generation

WangEditor v5 was discovered to contain a cross-site scripting XSS vulnerability via the component /dist/index.js...

Denial Of Service (DoS)

fastify/multipart is vulnerable to Denial Of Service DoS. The vulnerability exists in the fastifyMultipart function in index.js due to accepting unlimited number of file parts which can cause an application crash...

SUSE CVE-2021-23362

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service ReDoS via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity...

SUSE CVE-2021-44906

Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95...

Path Traversal

glance is vulnerable to Path Traversal. The vulnerability exists because the library does not properly sanitize relative paths in index.js, allowing an attacker to read files outside the public root directory by providing malicious relative paths...

Regular Expression Denial Of Service (ReDoS)

sideway/formula is vulnerable to Regular Expression Denial Of Service ReDoS. The vulnerability exists in index.js due to regular expression complexity which allows attacker to provide crafted strings to the formula's parser that might lead to polynomial execution time causing an application crash...

Information Disclosure

@tinacms/app is vulnerable to Information Disclosure. The vulnerability exists because the viteBuild function in index.ts exposes environment variables to index.js, allowing an attacker to use a read only token to gain access to sensitive information...

CVE-2023-25164

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...

CVE-2023-25164

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...

CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...

PT-2023-19949

Name of the Vulnerable Software and Affected Versions @tinacms/cli versions 1.0.0 through 1.0.8 Description Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli that store sensitive values in the process.env variable are...