6880 matches found
Glassdoor: Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter
Hi there, I have found the xss vulnerability at: https://www.glassdoor.com/ via parameter: numSuggestions Summary: Affected Parameter: numSuggestions Browsers tested: Firefox, Chrome, Edge latest version Steps To Reproduce: Go to:...
@bigab/gulp-testee (>=0.0.1, <=0.0.2), books-fe-polymer-dev-sample (1.0.0) +13 more potentially affected by CVE-2021-23330 via launchpad (>=0.2.1, <=0.7.5)
launchpad NPM version =0.2.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =1.0.1, =0.2.0, =0.0.1, =0.0.5, =2.0.15, =1.0.1, =2.0.3, =3.4.2 Source cves: CVE-2021-23330 Source advisory: SNYK:JS-LAUNCHPAD-1044065...
Stored XSS by authenticated backend user with access to upload files
Impact Backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under t...
AZL-32281 CVE-2020-8277 affecting package python-gevent for versions less than 21.1.2-3
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions 15.2.1, 14.15.1, and 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and...
Google Firebase Js Sdk prototype contamination vulnerability
Google Firebase Js Sdk is a client-side code base for connecting to the Firebase backend service from Google. firebase/util versions prior to 0.3.4 contain a prototype contamination vulnerability that originates from the deepExtend function in DeepCopy.ts. An attacker could exploit this...
Debian: Security Advisory (DSA-4789-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4789-1 : codemirror-js - security update
It was discovered that codemirror, a browser-based text editor implemented in JavaScript, was vulnerable to regular expression denial-of-service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4789. The text...
Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Cod...
GHSA-M9HW-7XFV-WQG7 Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Cod...
[SECURITY] [DSA 4789-1] codemirror-js security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4789-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 12, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4789-1] codemirror-js security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4789-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 12, 2020 https://www.debian.org/security/faq -...
DSA-4789-1 codemirror-js - security update
Bulletin has no description...
PT-2020-21399
Name of the Vulnerable Software and Affected Versions json-logic-js versions prior to 2.0.0 Description The issue allows a malicious user to modify the prototype of Object through the method property name in the operation method. This can lead to modification of any existing property that will...
CVE-2020-7768
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...
Design/Logic Flaw
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...
CVE-2020-7768 Prototype Pollution
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...
CVE-2020-7768
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...
CVE-2020-7768: Improperly Controlled Modification of Object Prototype Attributes
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition...
PT-2020-19780 · Grpc · Grpc +1
Name of the Vulnerable Software and Affected Versions: grpc versions prior to 1.24.4 @grpc/grpc-js versions prior to 1.1.8 Description: The issue concerns Prototype Pollution via loadPackageDefinition. This affects the grpc and @grpc/grpc-js packages. Recommendations: For grpc versions prior to...