4647 matches found
Design/Logic Flaw
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::DiagScopeVariablesWalker::GetChildrenCount...
CVE-2023-37140
ChakraCore (branch master) contains a segmentation fault in Js::DiagScopeVariablesWalker::GetChildrenCount(), per CVE-2023-37140. Affected component: ChakraCore JavaScript engine; root cause: segmentation violation in the mentioned function. Documented impact indicates local attack vector with av...
CVE-2023-37142
CVE-2023-37142 is a ChakraCore vulnerability where a segmentation violation occurs in Js::EntryPointInfo::HasInlinees() on the master branch (cbb9b). The incident is documented with a CVSSv3.1 base score of 5.5 (MEDIUM) with LOCAL attack vector, LOW attack complexity, no privileges required, user...
CVE-2023-37141
ChakraCore (branch master cbb9b) is affected by a segmentation violation in the function Js::ProfilingHelpers::ProfiledNewScArray(). The vulnerability causes a crash (local impact) and is tied to the ChakraCore engine’s profiling array creation. Affected version is stated as cbb9b; no explicit ex...
CVE-2023-37139
ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots::IsDebuggerScopeSlotArray...
CVE-2023-37141
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers::ProfiledNewScArray...
CVE-2023-37142
ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::EntryPointInfo::HasInlinees...
Malicious code in @marcomayo.com/firefly-shared-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a546d2e7e1826bee115fabca6b2802aab96ca9f227b6998e3ff64ca63459fc00 The OpenSSF Package Analysis project identified '@marcomayo.com/firefly-shared-js' @ 1.999.0 npm as malicious. It is considered malicious becaus...
Malicious code in firefly-shared-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 540259a2eb130bcb8b4596b7a6458b6290bd5dd6b8846751f0475931083f7594 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...
Malicious code in perimeterx-fastly-js-edge-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 934118ad5800d3dc8e17c6e7ed99b345399d4eae19e298de4f8a35834f872cc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-679 Malicious code in perimeterx-fastly-js-edge-template (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 934118ad5800d3dc8e17c6e7ed99b345399d4eae19e298de4f8a35834f872cc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in zoomapps-customlayout-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e07392edf92e8d29e546869050e65c3d70bdf3d86285cd245a1464a1a4c4d560 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-1220 Malicious code in js-starter-code (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac64c737affe45fd76d9899026d4a4d2f775e04e0391693ffcb2dafa665b07c5 The OpenSSF Package Analysis project identified 'js-starter-code' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...
Malicious code in js-starter-code (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac64c737affe45fd76d9899026d4a4d2f775e04e0391693ffcb2dafa665b07c5 The OpenSSF Package Analysis project identified 'js-starter-code' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...
U.S. Dept Of Defense: CVE-2023-24488 xss on https://██████/
Vulnerability description not provided...
Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to the Angular JS (CVE-2023-26116, CVE-2023-26117, CVE-2023-26118)
Summary The Discovery Connectors in IBM App Connect Enterprise are vulnerable to a denial of service due to the Angular JS CVE-2023-26116, CVE-2023-26117, CVE-2023-26118. The fix removes Angular JS. Vulnerability Details CVEID:CVE-2023-26117 DESCRIPTION: AngularJS is vulnerable to a denial of...
Chrome V8 Type Confusion
Chrome: Extending non-extensible objects leads to type confusion in V8 SUMMARY v8::internal::JSObject::SetAccessor doesn't check if the receiver is extensible before adding a new property. A potential attacker can exploit the ability to extend non-extensible objects to achieve arbitrary code...
engine.io: Specially crafted HTTP request can trigger an uncaught exception
A flaw was found in engine.io. The Socket.IO Engine.IO is vulnerable to a denial of service caused by an uncaught exception flaw. By sending a specially-crafted HTTP request, a remote, authenticated attacker can cause the Node.js process to crash, resulting in a denial of service...
Malicious code in js-cookie-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4db21916d97f75d76cd031171b76c9c5a2223cd3549d141bde479c6babb0569c Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...
