4637 matches found
Design/Logic Flaw
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component...
CVE-2021-4229
CVE-2021-4229 affects ua-parser-js versions 0.7.29, 0.8.0, and 1.0.0, with a reported critical issue involving a crypto mining backdoor in the component. The identified fix is to upgrade to 0.7.30, 0.8.1, or 1.0.1. Connected documents provide this concrete detail about affected versions and remed...
CVE-2021-4229 ua-parser-js Crypto Mining backdoor
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component...
CVE-2021-4229 ua-parser-js Crypto Mining backdoor
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component...
CVE-2021-4229
A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component...
GitLab: XSS: `v-safe-html` is not safe enough
v-safe-html directive uses Dompurify to remove data-remote', 'data-url', 'data-type', 'data-method' attributes from HTML tags. Rails-js relies on another attribute, data-disable-with to show a HTML content when an user clicks on a disabled link. For example, the following text will bypass the...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Gitea 1.7.0 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically...
OESA-2022-1665 nodejs-minimist security update
This module is the guts of optimist's argument parser without all the fanciful decoration. Security Fixes: Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95.CVE-2021-44906...
Session Fixation
Overview passport is a Simple, unobtrusive authentication for Node.js. Affected versions of this package are vulnerable to Session Fixation. When a user logs in or logs out, the session is regenerated instead of being closed. Remediation Upgrade passport to version 0.6.0 or higher. References -...
dicer 安全漏洞
dicer is a very fast streaming multipart parser for mscdex individual developers. A security vulnerability exists in dicer. A malicious attacker can send modified forms to the server and crash the nodejs service. An attacker can send the payload over and over again, thus crashing the service over...
Malicious code in ddc-classnames-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e99acb40e304c7529f780536e9e0c06faa3d8e76d23a1d58b7573005c7b92200 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2377 Malicious code in ddc-classnames-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e99acb40e304c7529f780536e9e0c06faa3d8e76d23a1d58b7573005c7b92200 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Chain Sea Ai Chatbot System Cross-Site Scripting Vulnerability
Chain Sea Ai Chatbot System is an intelligent human customer service software from Chain Sea, China. Chain Sea Ai Chatbot System is vulnerable to a cross-site scripting vulnerability, which is caused by the product not filtering special characters in URL parameters and can be exploited for JS...
new packages: js-d3-flame-graph
An update is available for js-d3-flame-graph. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...
Review Board Cross-site scripting (XSS) vulnerability in the reviews dropdown
Cross-site scripting XSS vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name...
phpMyAdmin Cryptographic Vulnerability
The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach...
gnome-shell security and bug fix update
3.32.2-44 - Fix more JS warnings Resolves: 2025940 3.32.2-43 - Backport fix for CVE-2020-17489 Resolves: 1874259 3.32.2-42 - Backport WPA3 support Resolves: 1924593 3.32.2-41 - Add bugs introduced in backport for 1651378 Related: 2000918 - Tidy up patch list a bit...
GHSA-V6FP-H79X-9RQC phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/dboperations.js, js/tbloperations.js, libraries/classes/Operations.php, and sql.php...
GHSA-6WFJ-2MW7-P5CG phpMyAdmin micro history Implementation XSS Vulnerability
Cross-site scripting XSS vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery CSRF attack to crea...