510 matches found
CVE-2015-3073
CVE-2015-3073 この脆弱性により、リモート攻撃者はAdobe Readerの脆弱なインストール環境においてAPI制限を回避することが可能です。この脆弱性を悪用するにはユーザーの操作が必要であり、標的となるユーザーが悪意のあるページにアクセスするか、悪意のあるファイルを開く必要があります。 具体的な欠陥はAFParseDateに存在します。特定のJavaScript命令を含む特別に細工されたPDFを作成することで、JavaScript APIの制限を回避することが可能です。リモート攻撃者はこの脆弱性を悪用して任意のコードを実行する可能性があります。...
study-turbolinks-link
Uso de JavaScript https://github.com/turbolinks/turbolinksapi-reference root@kitploit: Turbolinks.visit'/home/two' // default is advance. Turbolinks.visit'/home/two', action: 'advance' Turbolinks.visit'/home/two', action: 'replace'...
MGASA-2026-0232 Updated nats-server packages fix security vulnerabilities
nats-server and its dependencies are updated to fix CVE-2025-30215 Missing access controls for JS API in multi-tenancy...
Improper Control of Dynamically-Managed Code Resources
Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the WebAssembly.promising and WebAssembly.Suspending JSPI APIs in...
CVE-2026-44225
Pulpy is a lightweight, cross-platform desktop application packager for web apps. Prior to 0.1.1, Pulpy injects a pulpy.fs JavaScript API into every packaged web application, giving it access to the host filesystem. A validateFsPath function is supposed to sandbox this access, but its blocklist i...
CVE-2018-19446
A File Write can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is used. An attacker can leverage this to gain remote code execution...
CVE-2018-19449
A File Write can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API Doc.exportAsFDF is used. An attacker can leverage this to gain remote code execution...
CVE-2018-19445
A command injection can occur for specially crafted PDF files in Foxit Reader SDK ActiveX Professional 5.4.0.1031 when the JavaScript API app.launchURL is used. An attacker can leverage this to gain remote code execution...
CVE-2024-39772
Mattermost Desktop App versions =5.8.0 fail to safeguard screen capture functionality which allows an attacker to silently capture high-quality screenshots via JavaScript APIs...
EUVD-2015-6660
Malware in sbrugna...
EUVD-2016-5216
Malware in sbrugna...
EUVD-2015-4461
Malware in sbrugna...
EUVD-2015-6663
Malware in sbrugna...
EUVD-2015-4472
Malware in sbrugna...
EUVD-2017-7608
Malware in sbrugna...
EUVD-2015-6654
Malware in sbrugna...
EUVD-2016-2146
Malware in sbrugna...
EUVD-2015-4471
Malware in sbrugna...