PT-2021-5821 · Node.Js +7 · Node.Js +7

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 12.22.4 Node.js versions prior to 14.17.4 Node.js versions prior to 16.6.0 Description: The issue is related to a use after free attack in Node.js, where an attacker might exploit memory corruption to change process...

OTRS Cross-Site Scripting Vulnerability (CNVD-2021-57225)

OTRS is an application of the German company OTRS. A cross-site scripting vulnerability exists in OTRS AG Time Accounting, which stems from the ability to inject malicious JS code into specific fields during the project creation screen. No details of the vulnerability are currently available...

CVE-2021-21442 XSS vulnerability in Time Accounting

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19...

CVE-2021-21442

CVE-2021-21442 describes a cross-site scripting (XSS) vulnerability in OTRS Time Accounting. The issue allows injecting malicious JavaScript into fields on the project creation screen, with potential execution in the Reporting screen. Affected product: OTRS Time Accounting 7.0.x prior to 7.0.19. ...

Moderate: Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.7]

Updated ovirt-engine packages that fix several bugs and add various enhancements are now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available f...

OSV-2021-1039 Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36388 Crash type: Use-after-poison WRITE 8 Crash state: AK::RefPtr ::RefPtr AK::String::String JS::abstractrelation...

CVE-2021-2411

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: JS module. Supported versions that are affected are 8.0.25 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Cluster. Successfu...

Oracle MySQL Cluster Denial of Service Vulnerability (CNVD-2021-57180)

MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database. A security vulnerability exists in the Cluster: JS module component in Oracle MySQL Cluster 8.0.25 and earlier. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2021-2411

CVE-2021-2411 affects Oracle MySQL Cluster (Cluster: JS module) with affected versions 8.0.25 and earlier. The vulnerability is exploitable by an unauthenticated attacker over network via multiple protocols, leading to partial denial of service of MySQL Cluster. The connected sources confirm the ...

Oracle MySQL Cluster 输入验证错误漏洞

MySQL Cluster is a write-scalable, real-time, ACID-compatible transactional database. A security vulnerability exists in the Cluster: JS module component in Oracle MySQL Cluster 8.0.25 and earlier. An attacker can exploit this vulnerability to cause a denial of service...

CVE-2021-24452 W3 Total Cache < 2.1.5 - Reflected XSS in Extensions Page (JS Context)

The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting XSS issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript...

U.S. Dept Of Defense: Reflected XSS on [█████████]

Summary: Hi security team members, I found a reflected XSS on the URL Impact 1. An attacker can steal the victim's cookies. 2. An attacker can execute JS code. System Hosts █████ Affected Products and Versions CVE Numbers Steps to Reproduce 1. Navigate to this link:-...

ccxvii mujs 缓冲区错误漏洞

ccxvii mujs is an open source embeddable C interpreter. ccxvii mujs suffers from a buffer error vulnerability that originates from a buffer overflow vulnerability in the jsGmarkobject function in jsgc.c of mujs. Exploitation of this vulnerability allows remote attackers to cause a denial of servi...

ALPINE-CVE-2021-22918

Node.js before 16.4.1, 14.17.2, 12.22.2 is vulnerable to an out-of-bounds read when uvidnatoascii is used to convert strings to ASCII. The pointer p is read and increased without checking whether it is beyond pe, with the latter holding a pointer to the end of the buffer. This can lead to...

CVE-2021-30121

Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp A valid sessionId is required but can be easily obtained via CVE-2021-30118...

js-stellar-sdk authorization issue vulnerability

js-stellar-sdk is an application. A Javascript library for communicating with the Stellar Horizon server. A security vulnerability exists in Js-stellar-sdk versions prior to 8.2.3, which stems from the program's "Utils.readChallengeTx" function not verifying that the server has signed the...

CVE-2021-32738

js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The Utils.readChallengeTx function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the...

XSS Injection in Media Collection Title was possible

Impact A logged in admin user was possible to add a script injection XSS in the collection title which was executed. Workarounds Manual patching the js files. For more information If you have any questions or comments about this advisory:' - Email us at [email protected]...

GHSA-GM2X-6475-G9R8 XSS Injection in Media Collection Title was possible

Impact A logged in admin user was possible to add a script injection XSS in the collection title which was executed. Workarounds Manual patching the js files. For more information If you have any questions or comments about this advisory:' - Email us at [email protected]...

CVE-2021-32738

CVE-2021-32738 affects the js-stellar-sdk library used to interact with Stellar Horizon. The vulnerability lies in Utils.readChallengeTx, which, before version 8.2.3, did not verify that the server signature was present on the challenge transaction; however, signature verification via Utils.verif...