JerryScript 代码问题漏洞

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in parserparsefunctionstatement in js-parser-statm.c:733 in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...

JerryScript 代码问题漏洞

JerryScript is a lightweight JavaScript engine . A security vulnerability exists in parserparsestatements in js-parser-statm.c:2756 in JerryScript version 2.2.0. No details of the vulnerability are provided at this time...

CVE-2020-23308: Reachable Assertion

There is an Assertion 'contextp-stacktopuint8 == LEXEREXPRESSIONSTART' at js-parser-expr.c:3565 in parserparseexpression in JerryScript 2.2.0...

CVE-2020-23311: Reachable Assertion

There is an Assertion 'contextp-token.type == LEXERRIGHTBRACE || contextp-token.type == LEXERASSIGN || contextp-token.type == LEXERCOMMA' failed at js-parser-expr.c:3230 in parserparseobjectinitializer in JerryScript 2.2.0...

CVE-2020-23312: Reachable Assertion

There is an Assertion 'context.statusflags & PARSERSCANNINGSUCCESSFUL' failed at js-parser.c:2185 in parserparsesource in JerryScript 2.2.0...

OSV-2021-843 Use-after-poison in AK::NonnullOwnPtr<JS::IndexedPropertyStorage>::operator->

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35038 Crash type: Use-after-poison READ 8 Crash state: AK::NonnullOwnPtr::operator- JS::IndexedProperties::arraylikesize JS::IndexedProperties::append...

PT-2021-28298

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of Use-after-poison READ 8. The crash state involves several function calls, including AK::NonnullOwnPtr::operator-,...

Prototype Pollution

Overview Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution. Recommendation Avoid using js-extend as there is no current safe version of this module References - CVE - GitHub Advisory...

GHSA-MH82-55CM-6GFH Prototype pollution vulnerability in js-extend

Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution...

@cag-group/google-api-tools (0.3.1), @doodle3d/superlogin (>=0.6.2, <=0.7.0) +182 more potentially affected by CVE-2021-25945 via js-extend (1.0.1)

js-extend NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on js-extend and may be impacted: - @cag-group/google-api-tools 0.3.1 - @doodle3d/superlogin =0.6.2, =2.1.12, =1.0.2, =0.0.0, =0.0.49, =1.0.0, =4.2.0, =0.3.4, =0.1.21, =0.0.1-a,...

Prototype pollution vulnerability in js-extend

Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution...

serenity:FuzzJs: Use-after-poison in AK::RefPtr<AK::StringImpl, AK::RefPtrTraits<AK::StringImpl> >::RefPtr

Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=5498967109533696 Project: serenity Fuzzing Engine: honggfuzz Fuzz Target: FuzzJs Job Type: honggfuzzasanserenity Platform Id: linux Crash Type: Use-after-poison WRITE 8 Crash Address:...

Semrush: API key (api.semrush.com) leak in JS-file

The researcher found a javascript file with an API token that allowed to get internal statistics. When you access a page not found on the application, the source code of the page contains a portion of code that list a lot of javascript files. Some of these javascript files correspond to the Semru...

PT-2021-28296

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type identified as "Use-after-poison WRITE 8". The crash state involves several components, including AK::RefPtr ::RefPtr...

CVE-2020-35971

A storage XSS vulnerability is found in YzmCMS v5.8, which can be used by attackers to inject JS code and attack malicious XSS on the /admin/systemmanage/userconfigedit.html page...

CVE-2020-35971

CVE-2020-35971 concerns a storage XSS in YzmCMS v5.8 affecting the page /admin/system_manage/user_config_edit.html . The vulnerability allows attackers to inject JavaScript/HTML, implying persistent script execution via stored payloads. The connected CNVD/CNNVD records describe a cross-site scrip...

AZL-44862 CVE-2020-28469 affecting package js-jquery 3.5.0-4

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator...

Unspecified vulnerability in js-extend

js-extend is a module for Npm with extension capabilities. A security vulnerability exists in js-extend versions 0.0.1 through 1.0.1, which can be exploited by an attacker to cause a denial of service and possibly remote code execution...

CVE-2020-35973: Improper Neutralization of Input During Web Page Generation

An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php...

PT-2021-11889

Name of the Vulnerable Software and Affected Versions: zzcms2020 affected versions not specified Description: The issue is related to a XSS vulnerability that allows arbitrary insertion and execution of JS code via the /user/manage.php endpoint. Recommendations: At the moment, there is no...