Node.js: Fetch API did not protect against CRLF injection in host headers

A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection...

Malicious code in mapi-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c898d0a405d3dbdd1d8f7534d31152e30eb107a587e3b71d6ebb46116d22746 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-581 Malicious code in mapi-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c898d0a405d3dbdd1d8f7534d31152e30eb107a587e3b71d6ebb46116d22746 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Node.js ua-parser-js

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Node.js ua-parser-js. Vulnerability Details CVEID:CVE-2022-25927 DESCRIPTION: Node.js ua-parser-js module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS...

GHSA-J5C3-R84F-9596 Arbitrary File Read in Admin JS CSS files

Impact It was observed that the /admin/misc/script-proxy API endpoint accessible by an authenticated administrator user and is vulnerable arbitrary JavaScript, CSS file read via the "scriptPath" and "scripts" parameters. The "scriptPath" parameter is not sanitized properly and is vulnerable to pa...

Arbitrary File Read in Admin JS CSS files

Impact It was observed that the /admin/misc/script-proxy API endpoint accessible by an authenticated administrator user and is vulnerable arbitrary JavaScript, CSS file read via the "scriptPath" and "scripts" parameters. The "scriptPath" parameter is not sanitized properly and is vulnerable to pa...

CVE-2023-30852 Pimcore Arbitrary File Read in Admin JS CSS files

Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the /admin/misc/script-proxy API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the scriptPath and scripts parameters. The...

MAL-2023-1306 Malicious code in store-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4462b056f6144f0a42e19147fcc9c5a0277e45631c26bebad88d24513995b773 The OpenSSF Package Analysis project identified 'store-js-sdk' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in store-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4462b056f6144f0a42e19147fcc9c5a0277e45631c26bebad88d24513995b773 The OpenSSF Package Analysis project identified 'store-js-sdk' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Debian DSA-5392-1 : thunderbird - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5392 advisory. - matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. In versions prior to 24.0.0 events sent with special strings in key places can...

Debian dla-3400 : thunderbird - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3400 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3400-1 [email protected]...

Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to the ua-parser-js module (CVE-2022-25927)

Summary IBM App Connect Enterprise is vulnerable to a denial of service due to the ua-parser-js module in the electron app CVE-2022-25927. Electron is used for Discovery Connectors in IBM App Connect Enterprise. The latest fixpack includes ua-parser-js =v1.0.33 Vulnerability Details...

Missing Authorization

matrix-js-sdk is vulnerable to Missing Authorization. The vulnerability exists because a user can join a MSC3401 group call without notifying other users, which allows an attacker to perform invisible eavesdropping in group calls...

Oracle Linux 9 : thunderbird (ELSA-2023-1809)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-1809 advisory. 102.10.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 102.10.0-2 - Update to 102.10.0 build2 102.10.0-...

Oracle Linux 7 : thunderbird (ELSA-2023-1806)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-1806 advisory. 102.10.0-2.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js - Enabled aarch64 build 102.10.0-2 - Update to...

CVE-2015-10103

A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the loca...

CVE-2015-10103

CVE-2015-10103 affects InternalError503 Forget It up to version 1.3. The vulnerability resides in js/settings.js where manipulating the setForgetTime argument with input 0 leads to an infinite loop, enabling a local attack vector. Upgrading to version 1.4 addresses this issue; the patch is identi...

RHEL 8 : thunderbird (RHSA-2023:1802)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1802 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.10.0. Security Fixes:...

RHEL 7 : thunderbird (RHSA-2023:1806)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1806 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.10.0. Security Fixes:...

CVE-2023-29529

matrix-js-sdk is the Matrix Client-Server SDK for JavaScript and TypeScript. An attacker present in a room where an MSC3401 group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker...