4645 matches found
CVE-2022-2422
CVE-2022-2422 describes a SQL injection in Feathers.js when using feathers-sequelize, caused by improper input validation in the library. Reports from multiple sources (NVD, Veracode, GHSA, OSV, CVE list) indicate a high/critical impact with potential remote exploitation via standard network vect...
CVE-2022-29822
CVE-2022-29822 involves a SQL injection risk in Feathers Sequelize. Multiple connected sources describe a flaw in the Feathersjs/Feathers-Sequelize stack where improper parameter filtering (notably in the _find path of index.js) allows attacker-controlled input to influence SQL queries. The vulne...
CVE-2022-2422 Feathers - SQL injection via attribute aliases
Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used...
CVE-2022-29822 Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection
Due to improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injection...
CVE-2022-38901
A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...
Cross site scripting
A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...
CVE-2022-38901
A Cross-site scripting XSS vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file...
KLA20011 Multiple vulnerabilities in Mozilla Firefox ESR
Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Memory safety vulnerability can be exploited to execute...
AZL-45309 CVE-2022-37602 affecting package js-jquery 3.5.0-4
Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js...
Prototype Pollution
js-beautify is vulnerable to prototype pollution. An attacker is able to pollute any future object creations by passing a crafted malicious payload to mergeOpts function in options.js via the name variable...
CVE-2022-38902
A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...
Cross site scripting
A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...
CVE-2022-38902
A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...
CVE-2022-38902
A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...
Creating Awareness of External JavaScript Libraries in Web Applications
Qualys Web Application Scanning WAS routinely reviews and solicits customer feedback regarding vulnerabilities. This may be to enhance the detection or the detections reporting. Previously, all JavaScript libraries detected on an application are reported under the Information Gathering QID 150176...
CVE-2022-37609
Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js...
CVE-2022-37609
Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js...
CVE-2022-37609
Prototype pollution vulnerability in beautify-web js-beautify 1.13.7 via the name variable in options.js...