MAL-2024-1207 Malicious code in payable-js-ipg-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4236d1ddc2eb9ca710a495ee98481d2a581fee6451b8e496835e93c54f92c1a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-2954 · Node.Js +3 · Undici +3

Name of the Vulnerable Software and Affected Versions: Undici versions prior to 5.28.4 Undici versions prior to 6.11.1 Description: The issue is related to the Undici HTTP/1.1 client for Node.js, which has a flaw in its authorization procedure. Specifically, Undici clears Authorization and...

MAL-2024-1194 Malicious code in shopify-app-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ab44e75760c84102aeb55e53e2c77bb85fc0839e0873eb6dc778f14756e0bd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS)

EasyCorp is vulnerable to the Cross-site Scripting XSS. The vulnerability is due to improper handling of the 'item' argument in the Autocomplete function within the file assets/js/autocomplete.js of the Autocomplete component, leading to cross-site scripting XSS attacks...

CVE-2024-3081 EasyCorp EasyAdmin Autocomplete autocomplete.js cross site scripting

A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. T...

CVE-2024-3081 EasyCorp EasyAdmin Autocomplete autocomplete.js cross site scripting

A vulnerability was found in EasyCorp EasyAdmin up to 4.8.9. It has been declared as problematic. Affected by this vulnerability is the function Autocomplete of the file assets/js/autocomplete.js of the component Autocomplete. The manipulation of the argument item leads to cross site scripting. T...

Cross-site Scripting (XSS)

phpMyFAQ is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the handling of file attachments. An attacker with admin privileges can upload an attachment containing JS code without an extension, and the application will render it as HTML, leading to the execution of arbitrary...

Security Bulletin: IBM Planning Analytics Workspace has addressed multiple vulnerabilities

Summary IBM Planning Analytics Workspace is considered vulnerable to a Malicious File Upload vulnerability which could allow a privileged user to upload malicious files that can be automatically processed within the product CVE-2023-42017. This vulnerability has been addressed. IBM Planning...

DRUPAL-CONTRIB-2024-016

This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting XSS vulnerability. More details are available in CVE-2023-3620. This vulnerability is...

AZL-43690 CVE-2024-29041 affecting package nodejs-nodemon 2.0.3-4

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an...

CVE-2024-29179 phpMyFAQ Stored Cross-site Scripting at File Attachments

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. An attacker with admin privileges can upload an attachment containing JS code without extension and the application will render it as HTML which allows for XSS attacks...

CVE-2024-29179

CVE-2024-29179 concerns phpMyFAQ, an open source FAQ app. The vulnerability arises when an administrator uploads an attachment containing JavaScript code without an extension; the application then renders the attachment as HTML, enabling stored XSS. Attacks require admin privileges and leverage t...

nodejs: reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

A flaw was found in Node.js due to a lack of safeguards on chunk extension bytes. The server may read an unbounded number of bytes from a single connection, which can allow an attacker to send a specially crafted HTTP request with chunked encoding, leading to resource exhaustion and a denial of...

setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped such privileges through a call to setuid(). This vulnerability affects all users using version greater or equal than Node.js 18.18.0 Node.js 20.4.0 and Node.js 21.

...

AZL-35898 CVE-2024-22025 affecting package nodejs for versions less than 20.14.0-1

A vulnerability in Node.js has been identified, allowing for a Denial of Service DoS attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability stems from the fact that the fetch function in Node.js always decodes Brotli, making i...

Malicious code in custom-header-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21903596de696f90e7f282e9b7b39253671854a1f17f93630e04da0d8779743f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1117 Malicious code in custom-header-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21903596de696f90e7f282e9b7b39253671854a1f17f93630e04da0d8779743f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AZL-44493 CVE-2024-28849 affecting package js-jquery 3.5.0-4

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials...

AZL-43861 CVE-2024-28849 affecting package js-jquery 3.5.0-4

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials...

CVE-2024-28823

CVE-2024-28823 affects Amazon AWS aws-js-s3-explorer (1.0.0) . The vulnerability allows XSS when an attacker uses a crafted S3 bucket name that targets the explorer’s index.html. The root cause is a cross-site scripting vector via user-controlled bucket names, enabling execution of malicious scri...