CVE-2024-33259

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scannerseek at jerry-core/parser/js/js-scanner-util.c...

CVE-2024-33260

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parserparseclass at jerry-core/parser/js/js-parser-expr.c...

CVE-2024-33259

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component scannerseek at jerry-core/parser/js/js-scanner-util.c...

CVE-2024-33260

Jerryscript commit cefd391 was discovered to contain a segmentation violation via the component parserparseclass at jerry-core/parser/js/js-parser-expr.c...

nodejs: code injection and privilege escalation through Linux capabilities

A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if an unprivileged user has set them while the process is running with elevated privileges, except for CAPNETBINDSERVICE. Due to a bug in the implementation of this exception, Node.js incorrectly applies this...

Keenetic KN-1010 信息泄露漏洞

Keenetic KN is a series of routers from Keenetic. An information disclosure vulnerability exists in Keenetic KN-1010, which stems from an information disclosure vulnerability in file/version.js. Affected products and versions: Keenetic KN-1010, KN-1410, KN-1711, KN-1810, and KN-1910 4.1.2.15 and...

Add Custom CSS and JS <= 1.20 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack Make an author or above role open the following HTML: alert"frontendjs"' /...

GHSA-8M45-2RJM-J347 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

Handling untrusted input can result in a crash, leading to loss of availability / denial of service

Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a loss of availability...

CVE-2024-30253 Handling untrusted input can result in a crash, leading to loss of availability / denial of service

@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with @solana/web3.js will result in memory exhaustion OOM. If you have a server, client, mobile, or desktop product that accepts untrusted input for use with @solana/web3.js, your application/service may crash, resulting in a...

CVE-2022-47151

CVE-2022-47151 affects WordPress JS Help Desk – Best Help Desk & Support Plugin up to version 2.7.1. The vulnerability is an unauthenticated SQL Injection due to improper neutralization of SQL elements in the plugin, enabling potentially dangerous SQL execution without authentication. Impact is h...

web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in solana/web3.js that stems from allowing an attacker to cause an out-of-memory OOM using specific input...

PT-2024-23300 · Solana · @Solana/Web3.Js

Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions prior to 1.0.1 @solana/web3.js versions prior to 1.10.2 @solana/web3.js versions prior to 1.11.1 @solana/web3.js versions prior to 1.12.1 @solana/web3.js versions prior to 1.1.2 @solana/web3.js versions prior to 1.13....

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service and remote attack due to node.js jose module and jsonata-js JSONata (CVE-2024-28176, CVE-2024-27307)

Summary The Discovery Connector nodes in IBM App Connect Enterprise are vulnerable to a denial of service due to node.js jose module and jsonata-js JSONata. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-28176 DESCRIPTION: Node.js jos...

Shortcodes and extra features for Phlox theme <= 2.15.5 - Contributor+ Stored XSS via Custom JS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the custom JS parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will...

CVE-2023-51672

creationtimestamp| type| source ---|---|--- 2024-04-13 01:26:35+00:00| seen| https://t.me/arpsyndicate/4622...

JS Help Desk – Best Help Desk & Support Plugin < 2.8.4 - Missing Authorization

Description The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to perform an unauthorized action...

The vulnerability in the HTTP/1.1 client of the Node.js software platform arises from insufficient protection of service data due to improper cleaning of Proxy-Authentication headers. This allows attackers to enhance their privileges.

The vulnerability of the HTTP/1.1 Undici software platform for Node.js is related to insufficient protection of service data due to improper cleaning of Proxy-Authentication headers. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

Malicious code in payable-js-ipg-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4236d1ddc2eb9ca710a495ee98481d2a581fee6451b8e496835e93c54f92c1a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in payable-js-ipg-sdk-suba (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d702ab64f07220d7376645a0d0ad2d86688a3162960e49bd09ae493b567f43ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...