6881 matches found
EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-1016)
According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different...
EulerOS 2.0 SP9 : python-lxml (EulerOS-SA-2021-1035)
According to the version of the python-lxml package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different...
AZL-44940 CVE-2020-28282 affecting package js-jquery 3.5.0-4
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution...
@bartificer/human-join (>=1.0.0, <=1.0.1), @frdl/custom-require (>=0.0.0, <=0.0.12) +43 more potentially affected by unknown CVE via node-ini (1.0.0)
node-ini NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on node-ini and may be impacted: - @bartificer/human-join =1.0.0, =0.0.0, =5.0.5, =0.0.3, =1.0.1, =1.1.0, =0.0.0, =0.1.0, =0.0.0, =1.1.1, =0.0.1, =0.0.2, =0.0.3 - chowder 0.0.1 and...
CVE-2020-26286
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that...
h1-ctf: Hacky Holidays Writeup
On December 12th, 2020, the CTF became live and the scope that we are allowed to attack was In Scope Domain - hackyholidays.h1ctf.com Our main motive was to infiltrate his network and take him down. The challenges appeared one by one till 24th of December. Here we will be going through all the...
CVE-2020-26286: Unrestricted Upload of File with Dangerous Type
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that...
h1-ctf: ctf walkthrough
Hi, finally managed to solve all challenges, this was my first h1ctf, some challenges were pretty nice, some others had some frustrating guessing parts, but overall it was fun. Here goes day1 to day12 walkthroughs: Day 1 we have only one asset in scope hackyholidays.h1ctf.com the main page at...
Regular Expression Denial Of Service (ReDoS)
ua-parser-js is vulnerable to regular expression denial of service ReDoS. The vulnerability exists through overly greedy regular expressions when parsing the browsers' user agent strings...
CVE-2020-20285
There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php...
GHSA-FFXG-XM4W-3WG9 Command Injection in corenlp-js-interface
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
Command Injection in corenlp-js-interface
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...
Prototype Pollution
js-data is vulnerable to pollution prototype. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the deepMixIn function...
CVE-2020-28442
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...
CVE-2020-28442
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...
CVE-2020-28442
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...
CVE-2020-28442
CVE-2020-28442 (js-data) : Multiple connected sources confirm Prototype Pollution in js-data via the deepFillIn function and, in some advisories, the set function. Affected are all versions prior to the fix, with an incomplete remediation described; the OSV/GHSA entries specify vulnerability acro...
CVE-2020-28442: Undefined Security Weakness
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function...
PT-2020-17011
Name of the Vulnerable Software and Affected Versions js-data versions prior to 3.0.10 Description The issue concerns Prototype Pollution via the deepFillIn function. This allows for potential manipulation of object properties. No information is provided about the estimated number of affected...
