Prototype Pollution

Overview org.webjars.npm:pace-js is an Automatically add a progress bar to your site. Affected versions of this package are vulnerable to Prototype Pollution via the extend function, which recursively copies key-value pairs from the source object without properly validating property names. An...

LoLLMs 安全漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to v9.8, which stems from an unverified path connection in the servejs function in app.py. An attacker exploiting this vulnerability can...

CVE-2024-47169 Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those...

CVE-2024-8725

Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with...

SafeLine - Serve As A Reverse Proxy To Protect Your Web Services From Attacks And Exploits

SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web apps from attacks such as SQL...

WordPress CSS JS Files Plugin <= 1.5.0 is vulnerable to Directory Traversal

Software CSS JS Files Type Plugin Vulnerable versions = 1.5.0 Fixed in 1.5.1 OWASP Top 10 A3: Injection Classification Directory Traversal CVE CVE-2024-9146 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID eaa2d0720275 Credits jsjp Required privilege Administrator Published...

Malicious code in tq-assignment-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7f3696cd235e903c072e0f059768eac6d02449c0391742e708b6ce69250e1a15 The OpenSSF Package Analysis project identified 'tq-assignment-js' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

dingfanzu 跨站脚本漏洞

dingfanzu is a php-based food ordering website developed by gk2007, an individual developer. A cross-site scripting vulnerability exists in dingfanzu, which originates from the parameter address-name in the scripts/order.js file in the Order Checkout component and can lead to cross-site scripting...

Malicious code in kk4845.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38684730b01368b7ae01946765e8bb76b27127d47d68019c175e498d92f577fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8902 Malicious code in kk4845.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38684730b01368b7ae01946765e8bb76b27127d47d68019c175e498d92f577fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8910 Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-7389 · Unknown +1 · Matrix-Js-Sdk +1

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions 9.11.0 through 34.7.0 Description: The issue is related to the MatrixClient.sendSharedHistoryKeys method in the matrix-js-sdk, which is vulnerable to interception by malicious homeservers. This method is used to share...

whatsapp-api-js fails to validate message's signature

Impact Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. Patches Patched in version 4.0.3. Workarounds It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is...

CVE-2024-45607

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...

CVE-2024-45607 whatsapp-api-js fails to validate message's signature

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...

CVE-2024-45607 whatsapp-api-js fails to validate message's signature

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...

CVE-2024-45607 whatsapp-api-js fails to validate message's signature

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...

CVE-2024-45607

CVE-2024-45607 affects whatsapp-api-js, a TypeScript server-agnostic WhatsApp Official API framework. The issue is improper validation of request signatures in WhatsAppAPI.verifyRequestSignature, allowing incorrect access control by manipulating the signature verification process and potentially ...

CBL Mariner 2.0 Security Update: js-jquery (CVE-2019-20149)

The version of js-jquery installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-20149 advisory. - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attribute...