7031 matches found
Regular Expression Denial Of Service (ReDoS)
uglify-js is vulnerable to regular expression denial of service ReDoS. The inefficient regex pattern used in stringtemplate function in utils.js allows an attacker to input a malicious string, leading to an application crash...
XVIDEOS: Script breaking tag (Forces website to render blank) (Informative)
Summary: This is a bug affecting core HTML and JS elements on the site via Search Steps To Reproduce: 1. Open https://www.xvideos.com 2. Click to search enter payload= "" without quotes 3. Hit enter or search, watch the page break and not load any content content is loaded in console, renders pag...
WordPress JS Jobs Manager 1.1.7 Authorization Bypass
Exploit Title: Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation Google Dork: inurl:/wp-content/plugins/js-jobs/ Date: 22/09/2021 Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/js-jobs/ Version: spacehen www.github.com/spacehen" def...
Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation
Exploit Title: Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation Google Dork: inurl:/wp-content/plugins/js-jobs/ Date: 22/09/2021 Exploit Author: spacehen Vendor Homepage: https://wordpress.org/plugins/js-jobs/ Version: spacehen www.github.com/spacehen" def...
GHSA-X55W-VJJP-222R inflect vulnerable to Inefficient Regular Expression Complexity
inflect is customizable inflections for nodejs. inflect is vulnerable to Inefficient Regular Expression Complexity...
PT-2021-27825
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type identified as Use-after-poison READ 8. The crash state involves several function calls, including JS::Reference::put...
EulerOS 2.0 SP5 : python-lxml (EulerOS-SA-2021-2517)
According to the versions of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms argument...
EulerOS 2.0 SP8 : python-lxml (EulerOS-SA-2021-2483)
According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms...
nodejs: Use-after-free on close http2 on stream canceling
A flaw was found in Node.js, where it is vulnerable to a use-after-free attack. This flaw allows an attacker to exploit memory corruption to change process behavior. The highest threat from this vulnerability is to confidentiality and integrity...
The vulnerability in the `parser_parse_statements` function of the `js-parser-statm.c` component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to trigger a service failure.
The vulnerability of the parserparsestatements function in the js-parser-statm.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform is related to incorrect comparisons. Exploiting this vulnerability could allow a remote attacker to cause a service...
The vulnerability in the `parser_parse_source` function of the `js-parser.c` component of the JavaScript framework for the Internet of Things, JerryScript, and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to cause a service failure.
The vulnerability of the parserparsesource function in the js-parser.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform, is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cau...
The vulnerability of the `parser_parse_try_statement_end` function in the `js-parser-statm.c` component of the JavaScript engine for Thingscript and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to cause a service failure.
The vulnerability of the parserparsetrystatementend function in the js-parser-statm.c component of the JavaScript engine for the Internet of Things, JerryScript, and the IoT.js platform is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a remote...
The vulnerability of the `scanner_literal_is_created` function in the `js-scanner-util.c` component of the JavaScript IoT engine for JerryScript and the IoT.js platform is related to the insufficient use of the `assert()` function. This allows a malicious actor to trigger a service failure.
The vulnerability of the scannerliteraliscreated function in the js-scanner-util.c component of the JavaScript IoT scripting engine, JerryScript, and the IoT.js platform is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a remote attacker to cause...
The vulnerability in the `parser_emit_cbc_backward_branch` function of the `js-parser-util.c` component of the JavaScript engine for Internet of Things JerryScript and the IoT.js platform, related to the insufficient use of the `assert()` function, allows a attacker to trigger a service failure.
The vulnerability of the parseremitcbcbackwardbranch function in the js-parser-util.c component of the JavaScript engine for Internet of Things JerryScript and the IoT.js platform is related to the insufficient use of the assert function. Exploiting this vulnerability can allow a remote attacker ...
Basecamp: com.basecamp.bc3 Webview Javascript Injection and JS bridge takeover
It was identified that the android com.basecamp.bc3 application, contains a Webview where the loaded URLs are not sanitised properly. As this webview's functionality is extended via javascript interfaces and has the javascript enabled it is possible to inject arbitrary javascript code which will ...
Xiaomi community licensing issue vulnerability
Xiaomi Community, an official user community application of Xiaomi, China, is vulnerable to an authorization issue in versions prior to 3.0.210809, which stems from the exposure of some js interfaces. An attacker could use this vulnerability to maliciously invoke sensitive functions...
Inefficient Regular Expression Complexity in faisalman/ua-parser-js
Description Hello my dear I found another inefficient regular expression in ua-parser-js that have a Polynomial execution time not exponential but still dangerous. Proof of Concept I create two payloads that you can compare the execution times between them in Regexr provided links. payload 1...
CVE-2020-14130: Exposure of Resource to Wrong Sphere
Some js interfaces in the Xiaomi community were exposed, causing sensitive functions to be maliciously called on Xiaomi community app Affected Version 3.0.210809...
serenity:FuzzJs: Bad-cast to AK::Array<AK::TypeErasedParameter, 0>void JS::VM::throw_exception<JS::RangeError> in JS::div
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5819009270939648 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJs Job Type: libfuzzerubsanserenity Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffeb5cd4d78 Crash Stat...
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
Impact A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-en...