CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

DEBIAN-CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

Integer overflow

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

Node.js 安全特征问题漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in versions of Node.js prior to version 3.2.1 that stems from the crypto-js package generating random numbers by concatenating strings, but using integers, which makes the output predictable...

CVE-2020-36732

CVE-2020-36732 affects crypto-js used in IBM-related deployments. The underlying issue: crypto-js versions before 3.2.1 for Node.js generate random numbers by concatenating the string "0." with an integer, yielding less randomness than expected. The NVD metrics show a base score of 5.3 (Medium) w...

CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

PT-2023-11874

Name of the Vulnerable Software and Affected Versions: crypto-js versions prior to 3.2.1 Description: The issue concerns the generation of random numbers in the crypto-js package. Specifically, it concatenates the string "0." with an integer, making the output more predictable than necessary...

Stored XSS via Default session expiration time

Description The Default session expiration time feature when submitted HTML/JS tags executes the code in the login page. Proof of Concept Login to Teampass and go to Settings = Options. http://127.0.0.1/index.php?page=options In theDefault session expiration time input field insert an XSS payload...

PT-2023-24680 · Zxcvbn-Ts · Zxcvbn-Ts

Name of the Vulnerable Software and Affected Versions: zxcvbn-ts versions prior to 3.0.2 Description: This issue affects users running on the NodeJS platform who are using the second argument of the zxcvbn function. It can result in unbounded resource consumption as the user inputs array is...

inDrive: #1 XSS on watchdocs.indriverapp.com

The security vulnerability found on watchdocs.indriverapp.com allowed for cross-site scripting XSS attacks. The vulnerability was triggered by crafting a specific URL that executed arbitrary JavaScript code when accessed by users...

WordPress JS Job Manager Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software JS Job Manager Type Plugin Vulnerable versions = 2.0.0 Fixed in 2.0.1 OWASP Top 10 A2: Broken Authentication Classification Cross Site Request Forgery CSRF CVE CVE-2023-31087 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID cfbe0d0492f9 Credits Yuki Haruma Required...

Malicious code in libponenunber-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a89a63696ce9e53ae77cca0d28b82c9f35f8641a17d0e39f74636ab6fb4fbe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-567 Malicious code in libponenunber-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a89a63696ce9e53ae77cca0d28b82c9f35f8641a17d0e39f74636ab6fb4fbe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GLSA-202305-36 : Mozilla Thunderbird: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202305-36 Mozilla Thunderbird: Multiple Vulnerabilities - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can temporarily...

CVE-2023-32325

PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Content Security Policy is in place...

CVE-2023-32325 Cross-site scripting in PostHog-js

PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Content Security Policy is in place...

CVE-2023-32325 Cross-site scripting in PostHog-js

PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting. Problem has been patched in 1.57.2. Users are advised to upgrade. Users unable to upgrade should ensure that their Content Security Policy is in place...