4636 matches found
Moderate: Red Hat Security Advisory: Red Hat OpenShift Enterprise Logging bug fix and security update (5.3.3)
An update is now available for OpenShift Logging 5.3.3 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in t...
CVE-2020-23315
There is an ASSERTION pFuncBody-GetYieldRegister == oldYieldRegister failed in Js::DebugContext::RundownSourcesAndReparse in ChakraCore version 1.12.0.0-beta...
CVE-2021-46343
CVE-2021-46343 affects JerryScript 3.0.0. The vulnerability is a denial-of-service caused by an assertion failure: Failure: assertion 'context_p->token.type == LEXER_LITERAL' in /jerry-core/parser/js/js-parser-expr.c. Impact: reported as DoS; no further exploit/vector details are provided in t...
JerryScript 安全漏洞
JerryScript, a lightweight JavaScript engine from the JerryScript project, has a security vulnerability in JerryScript 3.0.0, which stems from an assertion in /jerry-core/parser/js/js-parser-expr.c flags & PARSERPATTERNHASRESTELEMENT fails. No details of the vulnerability are currently provided...
Design/Logic Flaw
An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...
CVE-2021-46170
An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...
CVE-2021-46170
Removed by vendor...
CVE-2021-46170
An issue was discovered in JerryScript commit a6ab5e9. There is an Use-After-Free in lexercompareidentifiertostring in js-lexer.c file...
CVE-2021-46170
CVE-2021-46170 describes a Use-After-Free in JerryScript’s lexer_compare_identifier_to_string (js-lexer.c) from commit a6ab5e9. The vulnerability is reported across multiple feeds (NVD, OSV, CNVD, UBuntu OSV, Debian, etc.). Affected component is the JerryScript JavaScript engine; root cause is a ...
Raven - Advanced Cyber Threat Map (Simplified, Customizable, Responsive)
Raven - Advanced Cyber Threat Map Simplified, customizable and responsive. It uses D3.js with TOPO JSON, has 247 countries, 100,000 cities, and can be used in an isolated environment without external lookups!. Live - Demo https://qeeqbox.github.io/raven/ Offline - Demo Features Uses D3.js Not...
GHSA-RRGW-3HG3-9X8C XSS vulnerability in translations
Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack...
XSS vulnerability in translations
Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack...
GHSA-C6H4-GC3F-HGJQ Prototype Pollution in js-data
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442...
CVE-2021-43852 JavaScript Prototype Pollution in oro/platform
OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are...
CVE-2021-43852
CVE-2021-43852 (OroPlatform) : A prototype pollution flaw allows an attacker to inject properties into JavaScript prototypes (e.g., Object prototypes) via specially crafted requests, potentially enabling JS code execution by vulnerable libraries. The issue is mitigated by patching to version 4.2....
Prototype Pollution
js-data is vulnerable to pollution prototype. The vulnerability exists due to an incomplete fix of CVE-2020-28442. A remote attacker is able to inject arbitrary properties into existing construct prototypes and modify attributes via the deepFillIn and the set functions resulting in prototype...
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Title Stored XSS in customattributes Description Relying on frontend URI check without verifying it on the backend allows to inject arbitrary JS code. Steps to reproduce 1. 1. Create a custom attribute, set its type to Link 2. 2. Navigate to any conversation, click on the right sidebar. 3. 3...
CVE-2021-23574
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442...
