keypairvuln

уязвимые ключи keypair CVE-2021-41117 Ключи, сгенерированные с помощью версий библиотеки keypair javascript уязвимых к CVE-2021-41117. Из-за ошибок в генераторе случайных чисел эта библиотека будет генерировать определенные ключи с более высокой вероятностью. Вероятность генерации одного из ключе...

InfoLeak-Scanner

InfoLeak-Scanner Docker Сначала выполните docker run --rm -p 8000:80 siwecos/infoleak-scanner. Откройте браузер и используйте сканер: http://localhost/?url= Установка Установите php5, curl и веб-сервер: sudo apt-get install apache2 php5 php5-curl Скопируйте приложение в веб-сервер: cp -R...

UBUNTU-CVE-2026-103923

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-2964-Lab

CVE‑2026‑2964 Lab – Prototype Pollution to RCE Этот репозиторий содержит полную лабораторную среду для CVE‑2026‑2964 — уязвимости prototype pollution в библиотеке web‑audio‑recorder‑js, которая при определённых условиях может привести к удалённому выполнению кода. Лабораторная среда включает:...

CVE-2026-103923 KaTeX: Existing prototype pollution can bypass trust restrictions

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration,...

CVE-2026-17495

A flaw was found in moment, a JavaScript library for handling dates. A remote attacker could exploit this vulnerability by providing a specially crafted input to the moment.locale function. This input, which is not a standard text string, can bypass security checks designed to prevent unauthorize...

CVE-2026-53496 ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes

ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load and the asynchronous file and URL loaders can pass attacker-supplied HEIC or AVIF data to the ISO-BMFF parser in src/image-header-iso-bmff.js, where findMetaBox and parseBox accept an eight-byte box header withou...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

CVE-2026-83618

creationtimestamp| type| source ---|---|--- 2026-09-08 22:35:19+00:00| published-proof-of-concept| https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp...

UBUNTU-CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge...

CVE-2026-83615

A flaw was found in xmldom, a JavaScript library for parsing XML documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document. When processed, this document would cause the library to consume an excessive amount of memory, leading to the application...

DEBIAN-CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstructiontarget, data in lib/dom.js accepts an unvalidated target, while...

DEBIAN-CVE-2026-83611

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString can silently accept an end tag such as , close the element, and discard th...

UBUNTU-CVE-2026-83609

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in lib/grammar.js compiles the anchored QNameexact validator with the multiline flag, so ^ and $ validate only one line instead of the complete...

CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QNameexact expression produced by reg in lib/grammar.js, which inherits the multiline...

CVE-2026-83612

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements...

UBUNTU-CVE-2026-83619

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression / \t\n\r+$/g. For an end tag containing a long whitespace run...

UBUNTU-CVE-2026-83607

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...