CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2020-8176

CVE-2020-8176 affects koa-shopify-auth, versions 3.1.61–3.1.62. The vulnerability is an XSS via the shop parameter in /shopify/auth/enable_cookies. Root cause cited across sources is lack of sanitization of the shop value in multiple files (e.g., auth/client/request-storage-access.ts, auth/client...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

Prototype Pollution

Overview Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to...

Shopify: xss on polaris.shopify.com/demo using postMessage

Description it's possible to run arbitrary js code using https://polaris.shopify.com/demo + postMessage following codes are from this file which formatted using prettier Demo component line 381 uses addEventListener to listen for message events line 401: js componentDidMount...

PT-2020-6419

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an assertion in the parser parse object initializer function in the js-parser-expr.c component of the JerryScript JavaScript engine for the Internet of Things. This assertion is...

PT-2020-6417

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an assertion in the parser parse function arguments function in JerryScript, specifically in the js-parser.c component. This assertion is context p-next scanner info p-type == SCANN...

PT-2020-6416

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an assertion in the parser emit cbc backward branch function in the js-parser-util.c component of the JerryScript engine for the Internet of Things. This assertion is 'flags CBC STA...

JSC JIT Out-Of-Bounds Access Vulnerability

The DFG and FTL JIT compilers incorrectly replace Checked with Unchecked ArithNegate operations and vice versa during Common Subexpression Elimination. This can then be exploited to cause out-of-bounds accesses and potentially other memory safety violations. JSC: JIT: Incorrect Common Subexpressi...

KLA11793 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in SharedWorkerService can b...

PT-2020-6412

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an incorrect comparison in the parser parse object initializer function of the js-parser-expr.c component in JerryScript. This could potentially allow a remote attacker to cause a...

PT-2020-6414

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to the scanner literal is created function in the js-scanner-util.c component of the JerryScript JavaScript engine for Internet of Things IoT. It is caused by insufficient use of the...

PT-2020-6413

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to the parser parse source function in the js-parser.c component of the JerryScript JavaScript engine for Internet of Things IoT devices. It involves an assertion failure, specifically...

PT-2020-6411

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an incorrect comparison in the parser parse function statement function of the js-parser-statm.c component in the JerryScript JavaScript engine for the Internet of Things. This can...

PT-2020-6415

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to the parser parse try statement end function in the js-parser-statm.c component of the JerryScript JavaScript engine for the Internet of Things. It involves an insufficient use of th...

PT-2020-6410

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an incorrect comparison in the parser parse statements function of the js-parser-statm.c component in the JerryScript JavaScript engine for the Internet of Things. This could...

PT-2020-6409

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to the parser parse expression function in the js-parser-expr.c component of the JerryScript JavaScript engine for Internet of Things IoT devices. It is caused by insufficient use of t...

CVE-2020-13649

parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scannerreverseinfolist NULL pointer dereference and a scannerscanall assertion failure...

CVE-2020-13649

parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scannerreverseinfolist NULL pointer dereference and a scannerscanall assertion failure...

CVE-2020-13649: NULL Pointer Dereference

parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scannerreverseinfolist NULL pointer dereference and a scannerscanall assertion failure...