Linux Distros Unpatched Vulnerability : CVE-2024-42369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the...

Linux Distros Unpatched Vulnerability : CVE-2024-36463

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The implementation of atob in Zabbix JS allows to create a string with arbitrary content and use it to access internal properties of objects. CVE-2024-36463 Not...

Linux Distros Unpatched Vulnerability : CVE-2023-28427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can...

Linux Distros Unpatched Vulnerability : CVE-2024-47080

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. In matrix-js-sdk versions versions 9.11.0 through 34.7.0, the method...

Linux Distros Unpatched Vulnerability : CVE-2022-36059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 19.4.0 events sent with special strings in key places can...

Linux Distros Unpatched Vulnerability : CVE-2023-29529

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can...

Linux Distros Unpatched Vulnerability : CVE-2021-40823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12.4.1 allows a malicious Matrix homeserver present in an...

Linux Distros Unpatched Vulnerability : CVE-2023-46233

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at...

MAL-2025-1909 Malicious code in orderly-js-sdk-cra-template (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in orderly-js-sdk-cra-template (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

GHSA-VF6X-59HH-332F Formwork has a cross-site scripting (XSS) vulnerability in Site title

Summary The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users. Impact The attack is widespread, leveraging what XSS can do...

Malicious code in ideal-paypal-payment-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0c63436afa43460fe75374c026568d5b5f17a29326ac24517be8a2b1dcd113 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in js-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc4563d5bd3e84486a04f455708e6480fadf633778880ca2710f2778aafad55c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25477

A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...

PT-2025-9042 · Syspass · Syspass

Name of the Vulnerable Software and Affected Versions: SysPass versions 3.2.x Description: A host header injection vulnerability in SysPass allows an attacker to load malicious JS files from an arbitrary domain, which would be executed in the victim's browser. Recommendations: For SysPass version...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in jsonata-js JSONata

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of jsonata-js JSONata. Vulnerability Details CVEID:CVE-2024-27307 DESCRIPTION: jsonata-js JSONata could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the JSONata...

The vulnerability of Visual Studio Code’s JS Debug editor, related to vulnerabilities in access control, allows attackers to escalate their privileges.

The vulnerability of Visual Studio Code’s JS Debug editor for source code editing is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to enhance their privileges...

PT-2025-7751 · Playerjs · Playerjs

Name of the Vulnerable Software and Affected Versions: PlayerJS versions n/a through 2.23 Description: The issue affects PlayerJS, allowing DOM-Based XSS due to improper neutralization of input during web page generation. This enables cross-site scripting. Recommendations: For versions n/a throug...

CVE-2025-27109

solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...