PT-2020-17009

Name of the Vulnerable Software and Affected Versions corenlp-js-prefab affected versions not specified Description The issue affects the corenlp-js-prefab package, which depends on a vulnerable package named corenlp-js-interface. The injection point is located in line 10 of the 'index.js' file...

ua-parser-js security vulnerability

ua-parser-js is a JavaScript-based parser for User-Agent strings. It can be used in a browser client-side or node.js server-side environment. Can also be used as a jQuery / Zepto plugin , Bower / Meteor package and RequireJS / AMD module . A security vulnerability exists in ua-parser-js prior to...

Noahdess Corenlp-js-prefab Command Injection Vulnerability

Noahdess Corenlp-js-prefab is a codebase for preprocessing text data written in JS by the Noahdess individual developer. A command injection vulnerability exists in Noahdess corenlp-js-prefab, which stems from an injection point located at line 10 in index.js. This depends on a vulnerable package...

PT-2020-17010

Name of the Vulnerable Software and Affected Versions corenlp-js-interface versions all Description The issue concerns Command Injection via the main function. Recommendations For all versions, consider disabling the main function as a temporary workaround until a patch is available. At the momen...

CVE-2020-28439: Improper Neutralization of Special Elements used in an OS Command

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...

CVE-2020-28440: Improper Neutralization of Special Elements used in an OS Command

All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function...

CVE-2020-7793: Undefined Security Weakness

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise (CVE-2019-1551)

Summary Vulnerabilities in OpenSSL affect IBM Integration Bus and IBM App Connect Enterprise . The DataDirect ODBC Drivers and level of node js used by IBM App Connect Enterprise and IBM Integration Bus have addressed the applicable CVEs Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION:...

Payment Card Skimmer Group Using Raccoon Info-Stealer to Siphon Off Data

A cybercrime group known for targeting e-commerce websites unleashed a "multi-stage malicious campaign" earlier this year designed with an intent to distribute information stealers and JavaScript-based payment skimmers. In a new report published today and shared with The Hacker News,...

[ASA-202012-1] python-lxml: cross-site scripting

Arch Linux Security Advisory ASA-202012-1 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-27783 Package : python-lxml Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-1319 Summary ======= The package python-lxml befo...

Command Injection

Overview spritesheet-js is a command-line spritesheet a.k.a. Texture Atlas generator written in node.js. Affected versions of this package are vulnerable to Command Injection. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which...

CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

CVE-2020-27783

The CVE-2020-27783 issue is a XSS vulnerability in python-lxml's HTML Cleaner. The Cleaner’s parser did not sufficiently emulate browsers, causing mismatches between sanitization and the rendered page. This can allow a remote attacker to run arbitrary HTML/JS in a victim’s browser. Affected produ...

CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

CVE-2020-27783: Improper Neutralization of Input During Web Page Generation

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

CVE-2020-27783

A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing different behaviors between the sanitizer and the user's page. This flaw allows a remote attacker to run arbitrary HTML/JS code. The highest threat...

PT-2020-17091

Name of the Vulnerable Software and Affected Versions LiquidFiles versions prior to 3.3.19 Description A Cross-Site Script Inclusion issue was found, which is a client-side attack that requires user interaction, such as opening a link. Successful exploitation could lead to encrypted e-mail conten...

CVE-2020-29072: Inclusion of Functionality from Untrusted Control Sphere

A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction opening a link and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js...