Malicious code in eg-clickstream-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0705bae9b8b83918363a34220367ce898de3e491c1f68e183ed880048b2f9d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-js-v13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efa16d135ce14e2cecb4cc4203b19a8ea5dde2ad02b34a62403aa10036938d20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2483 Malicious code in discord-js-v13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efa16d135ce14e2cecb4cc4203b19a8ea5dde2ad02b34a62403aa10036938d20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS where a particular piece of input will cause to enter an infinite loop and never return. PoC 1 Create a npm workspace npm init 2 Install the jpeg-js library 3 Create a JS file with the following code: js const jpeg...

Arbitrary Code Injection

gatsby-plugin-mdx is vulnerable to arbitrary code injection. The vulnerability exists because the gatsby-plugin-mdx allows JS engine for frontmatter by default due to untrusted inputs which allows an attacker to inject arbitrary codes...

Regular Expression Denial Of Service (ReDoS)

jquery-validation is vulnerable to regular expression denial of service. The vulnerability exists in addMethod in url2.js due to insufficient regular expression complexity which allows an attacker to cause a ReDoS...

GHSA-GWP3-F7MR-QPFV OS Command Injection in s3-uploader

OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commands via the metadata function...

CVE-2021-34082

OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allows attackers to execute arbitrary commands via the fix function...

ssl-utils 操作系统命令注入漏洞

ssl-utils is a wrapper for some OpenSSL commands around Node.js. A security vulnerability exists in ssl-utils version 1.0.0, which can be exploited by an attacker to execute arbitrary commands...

s3-uploader 操作系统命令注入漏洞

s3-uploader is flexible and efficient for image resizing, renaming and uploading to Amazon S3 disk storage. A security vulnerability in Turistforeningen node-s3-uploader 2.0.3 and earlier stems from a Node.js package insecurely passing data to the metadata function, which ultimately connects to a...

Malicious code in oms-js-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f979ac49e09f1b3b30af6ae6dbf7c93f84fa24836cfcee4df4f677a1522dde6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

js-space.de Cross Site Scripting vulnerability OBB-2634215

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-236C-VHJ4-GFXG Duplicate Advisory: Embedded malware in ua-parser-js

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pjwm-rvh2-c87w. This link is maintained to preserve external references. Original Description A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the...

GO-2022-0247 Buffer overflow in WASM modules in misc/wasm and cmd/link

When invoking functions from WASM modules, built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten with data from the arguments due to a buffer overflow error. If using wasmexec.js to execute WASM modules, users will need to replace their...

Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module

Cross-site scripting XSS vulnerability in the Frontend JS module before version 4.0.18, in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a...

GHSA-HGJV-7WJR-QWQP Liferay Portal and Liferay DXP Cross-site scripting (XSS) vulnerability in the Frontend JS module

Cross-site scripting XSS vulnerability in the Frontend JS module before version 4.0.18, in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a...

CVE-2021-4229

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component...

CVE-2021-4229

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component...

CVE-2021-4229

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component...