CVE-2024-50336 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the...

matrix-js-sdk 安全漏洞

matrix-js-sdk is an application component of Matrix open source. A security vulnerability exists in matrix-js-sdk versions prior to 34.11.1. An attacker can exploit this vulnerability to conduct a client-side path traversal attack via a specially crafted MXC URI...

Matrix clients -- mxc uri validation in js sdk

matrix-js-sdk upstream reports: matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver...

PT-2024-34149

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions prior to 34.11.0 Description: The issue concerns a client-side path traversal vulnerability via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated G...

Exception unhandled, lead to server crash

Description In node js express, if exception is uncaught, the server will crash. fs module sometimes throw exception when dealing with file upload. Unauth user can send something to the server trigger the exception lead to server crash. Proof of Concept import requests import random import string...

MAL-2024-10552 Malicious code in airpay-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c58278d1a1134ca2368bd39a9425c1d5137f218539dfe6f346931927bc6e9a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-51670

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through = 2.8.7...

CVE-2024-51670

CVE-2024-51670 – JS Help Desk WordPress Plugin : Affected plugin versions are

CVE-2024-51670 WordPress JS Help Desk plugin <= 2.8.7 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JoomSky JS Help Desk js-support-ticket allows Stored XSS.This issue affects JS Help Desk: from n/a through = 2.8.7...

AZL-52548 CVE-2024-21538 affecting package js-jquery 3.5.0-4

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string...

AZL-52587 CVE-2024-21538 affecting package js-jquery 3.5.0-4

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string...

Malicious code in ethrereum-js-tx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcdc76532c3b912681eb183f0654c2ef268dd8926cd3ee20b3265c930ed09865 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-43274

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6...

CVE-2024-43274

Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.6...

CVE-2024-43274

The CVE-2024-43274 entry affects the WordPress plugin “JS Help Desk – Best Help Desk & Support Plugin” (versions up to 2.8.6). Root cause: missing authorization leads to Broken Access Control, allowing unauthenticated actors to access functionality not properly constrained by ACLs. Impact is desc...

openSUSE: Security Advisory for 389 (SUSE-SU-2024:3844-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for 389 (SUSE-SU-2024:3843-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-30438

Name of the Vulnerable Software and Affected Versions JS Help Desk – Best Help Desk & Support Plugin versions n/a through 2.8.6 Description The issue affects the JS Help Desk plugin, allowing access to functionality not properly constrained by ACLs due to a missing authorization vulnerability...

MAL-2024-10299 Malicious code in @amagioss/js-timecode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cd0e634cb711f3c81ba053e00875d83653e7f7f70757ace4e3234b538bc5c88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the MatrixClient.sendSharedHistoryKeys function in the development tools for JavaScript and TypeScript matrix-js-sdk allows a hacker to bypass authentication procedures and gain unauthorized access to protected information.

The vulnerability of the MatrixClient.sendSharedHistoryKeys function in the JavaScript and TypeScript matrix-js-sdk development tools is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to bypass authentication procedures and gain...