4643 matches found
Malicious code in safebs58.js (npm)
The package contains a preinstall hook to execute unhook.js, which has cryptocurrency stealing functionality. --- -= Per source details. Do not edit below this line.=-...
MAL-2024-7886 Malicious code in safebs58.js (npm)
The package contains a preinstall hook to execute unhook.js, which has cryptocurrency stealing functionality. --- -= Per source details. Do not edit below this line.=-...
CVE-2024-7163 SeaCMS index.php cross site scripting
A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to initiate the attack remotely. The exploit...
The vulnerability of the Permission Model component in the Node.js software platform allows attackers to compromise the confidentiality and integrity of protected information.
The vulnerability of the Permission Model component in the Node.js software platform is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to compromise the confidentiality and integrity of protected information when the --allow-fs-write flag is used...
CVE-2024-38679
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Yongki Agustinus Animated Typed JS Shortcode allows Stored XSS.This issue affects Animated Typed JS Shortcode: from n/a through 2.0...
CVE-2024-38679 WordPress Animated Typed JS Shortcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Yongki Agustinus Animated Typed JS Shortcode allows Stored XSS.This issue affects Animated Typed JS Shortcode: from n/a through 2.0...
CVE-2024-38679 WordPress Animated Typed JS Shortcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Yongki Agustinus Animated Typed JS Shortcode allows Stored XSS.This issue affects Animated Typed JS Shortcode: from n/a through 2.0...
SUSE CVE-2023-46233
crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm...
WordPress Animated Typed JS Shortcode Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)
Software Animated Typed JS Shortcode Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38679 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 80aa662f11eb Credits LVT-tholv2k Required privilege...
Supply Chain Attack
yt-dlp is vulnerable to Supply Chain Attack. The vulnerability is due to the use of a compromised CDN cdn.bootcdn.net which is used to fetch a component of the crypto-js JavaScript library, allowing an attacker to potentially inject and execute malicious JavaScript code...
GHSA-3V33-3WMW-3785 yt-dlp has dependency on potentially malicious third-party code in Douyu extractors
Impact yt-dlp's DouyuTV and DouyuShow extractors used a cdn.bootcdn.net URL as a fallback for fetching a component of the crypto-js JavaScript library. When the Douyu extractor is used, yt-dlp extracts this JavaScript code and attempts to execute it externally using PhantomJS. bootcdn.net is owne...
Security Bulletin: Multiple vulnerabilities present in IBM Answer Retrieval for Watson Discovery versions 2.17 and earlier
Summary This fix upgrades to Websphere Liberty 24.0.0.6, socket.io 3.0.2, and grpc-js 1.8.22. Websphere Liberty is used by the IBM Answer Retrieval for Watson Discovery swagger microservice. Socket.io and grpc-js are used by the IBM Answer Retrieval for Watson Discovery user interfaces for...
CVE-2024-37145
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/chatflows-streaming/id endpoint. If the default configuration is used unauthenticated, an attacker may be able...
Use After Free
@fastly/js-compute is vulnerable to Use After Free. The vulnerability is due to re-use of previously freed memory in the FetchEvent.client and certain CacheEntry.prototype and Device.lookup functions. This issue could allow for an unintended data leak and often results in a Compute service crash...
CVE-2024-38375 @fastly/js-compute use-after-free in some host call implementations
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and...
Fastly js-compute-runtime security vulnerability
Fastly js-compute-runtime is a Fastly open source runtime environment. A security vulnerability exists in Fastly js-compute-runtime, which stems from the implementation of multiple functions containing post-release reuse vulnerabilities...
Malicious code in symbl-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-3073 Malicious code in symbl-js (npm)
--- -= Per source details. Do not edit below this line.=-...