CVE-2021-4260 oils-js Web.js redirect

A vulnerability was found in oils-js. It has been declared as critical. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads to open redirect. The attack can be initiated remotely. The name of the patch is fad8fbae824a7d367dacb90d56cb02c5cb999d42. It is...

Code injection

Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password...

UBUNTU-CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

GHSA-XVF7-4V9Q-58W6 Infinite loop in jpeg-js

The package jpeg-js before 0.4.4 is vulnerable to Denial of Service DoS where a particular piece of input will cause the program to enter an infinite loop and never return...

Design/Logic Flaw

The package jpeg-js before 0.4.4 are vulnerable to Denial of Service DoS where a particular piece of input will cause to enter an infinite loop and never return...

CVE-2022-25851

The package jpeg-js before 0.4.4 are vulnerable to Denial of Service DoS where a particular piece of input will cause to enter an infinite loop and never return...

08cms (=1.0.0), 18a58t9c-upload (>=1.0.0 <=1.0.3) +3452 more potentially affected by CVE-2022-25851 via jpeg-js (>=0.0.1 <=0.4.3)

jpeg-js NPM version =0.0.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =0.0.2, =0.0.1, =0.0.3, =1.0.0, =0.0.2, =2.2.1, =3.4.7 - @lan/uni-libs =0.0.3 and more Source cves: CVE-2022-25851 Source advisory: SNYK:JS-JPEGJS-2859218...

UBUNTU-CVE-2022-21824

Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...

GHSA-FF45-7PRW-58VJ OS Command injection in docker-cli-js

Withdrawn After reviewing this CVE, and this response from the maintainer, we have withdrawn this advisory. Original CVE description This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will ...

@pl-test/c (>=1.1.0 <=1.1.1), @pl-test/e (=1.1.0) +10 more potentially affected by CVE-2021-32831 via total.js (>=1.2.3 <=3.4.13)

total.js NPM version =1.2.3, =1.1.0, =0.1.5, =0.1.0, =4.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.4 Source cves: CVE-2021-32831 Source advisory: OSV:GHSA-VWHC-PWW7-72X6...

nodejs: Improper handling of untypical characters in domain names

A flaw was found in Node.js. These vulnerabilities include remote code execution, Cross-site scripting XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library, which can lead to the output of wrong hostnames leading to Domai...

ALPINE-CVE-2021-22918

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to...

@pl-test/c (>=1.1.0 <=1.1.1), @pl-test/e (=1.1.0) +6 more potentially affected by CVE-2021-23344 via total.js (>=3.2.4 <=3.4.13)

total.js NPM version =3.2.4, =1.1.0, =0.3.0, =4.0.0, =1.0.0, =0.0.1, =0.0.4 Source cves: CVE-2021-23344 Source advisory: SNYK:JS-TOTALJS-1077069...

nodejs: HTTP request smuggling via two copies of a header field in an http request

A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity...

@5minds/node-red-dashboard-2-processcube-dynamic-form (>=1.0.25-poc-for-using-dynamic-ui-from-app-sdk-4a73f4-m2ok3vom <=1.0.25-poc-for-using-dynamic-ui-from-app-sdk-d41e60-m2oo8xvq), @5minds/processcube_app_sdk (>=5.1.0-feature-1c1233-lsdsso3l <=8.6.2) +352 more potentially affected by unknown CVE via diagram-js (>=0.18.4 <=1.4.0)

diagram-js NPM version =0.18.4, =1.0.25-poc-for-using-dynamic-ui-from-app-sdk-4a73f4-m2ok3vom, =5.1.0-feature-1c1233-lsdsso3l, =1.2.0, =0.1.0-package-6ccc4e-lyitv9ph, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =1.0.98, =0.0.25, =0.3.0, =1.0.0, =0.0.1-alpha.0, =0.3.0 - @bptlab/openbpt-modeler-bpmn =1.0.0 and...

jl-wechat-sdk (>=1.0.0 <=1.2.3) potentially affected by unknown CVE via crpyto-js (=0.0.1-security)

crpyto-js NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on crpyto-js and may be impacted: - jl-wechat-sdk =1.0.0, =1.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-73C6-VWJH-G3QH...

Denial Of Service (DoS)

jpeg-js is vulnerable to denial of service DoS. The vulnerability exists as it fails to properly restrict the values of the resolution from the EXIF data, allowing a small manipulated image to cause a disproportionately large memory allocation...

CVE-2020-5263

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

CVE-2020-5263 Information disclosure through error object

auth0.js NPM package auth0-js greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an authentication error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. If the err...

GHSA-FQ77-7P7R-83RJ Directory Traversal in Next.js

Impact - Not affected: Deployments on ZEIT Now v2 https://zeit.co are not affected - Not affected: Deployments using the serverless target - Not affected: Deployments using next export - Affected: Users of Next.js below 9.3.2 We recommend everyone to upgrade regardless of whether you can reproduc...