Cross-Site Scripting in diagram-js

Versions of diagram-js prior to 3.3.1 for 3.x and 2.6.2 for 2.x are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript. Recommendation If you are using diagram-js 3.x, upgrade to version...

GHSA-8FW4-XH83-3J6Q Cross-Site Scripting in diagram-js

Versions of diagram-js prior to 3.3.1 for 3.x and 2.6.2 for 2.x are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript. Recommendation If you are using diagram-js 3.x, upgrade to version...

cassandra-query (>=1.0.1, <=1.0.3), toobatel-bot-lib-js (1.0.0) potentially affected by unknown CVE via blubird (0.0.1-security)

blubird NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on blubird and may be impacted: - cassandra-query =1.0.1, =1.0.3 - toobatel-bot-lib-js 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-RVWW-X6M4-4VC2...

Prototype Pollution

json-logic-js is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

PT-2020-21031

Name of the Vulnerable Software and Affected Versions react-datepicker-plus versions 2.4.3 through 2.4.2 Description The issue concerns malicious code in the affected versions of react-datepicker-plus. When executed in a browser, this code enumerates password, cvc, and cardnumber fields from form...

PT-2020-20952

Name of the Vulnerable Software and Affected Versions ember-power-timepicker version 1.0.8 Description The issue concerns malicious code in the ember-power-timepicker package that, when executed in a browser, can extract sensitive information such as password, cvc, and card number fields from...

PT-2020-21072

Name of the Vulnerable Software and Affected Versions precode.js version 1.1.1 Description The issue concerns malicious code in the specified version of precode.js, which when executed in a browser, can extract sensitive information such as password, cvc, and cardnumber fields from forms. This...

PT-2020-21230

Name of the Vulnerable Software and Affected Versions github-jquery-widgets version 0.1.2 Description The issue concerns malicious code in version 0.1.2 of github-jquery-widgets. When executed in a browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the extract...

PT-2020-21367

Name of the Vulnerable Software and Affected Versions diagram-js-direct-editing versions prior to 1.4.3 Description The issue arises from the package's failure to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser, thus facilitating...

PT-2020-21199

Name of the Vulnerable Software and Affected Versions grunt-radic version 0.1.1 Description The issue concerns malicious code in a specific version of the software. When executed in the browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the extracted values to...

PT-2020-21420

Name of the Vulnerable Software and Affected Versions geoheat version 1.3.2 Description The issue concerns malicious code in version 1.3.2 of geoheat. When executed in a browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the extracted values to the...

PT-2020-20973

Name of the Vulnerable Software and Affected Versions ng-ui-library version 1.0.987 Description The issue concerns malicious code in the ng-ui-library that, when executed in a browser, can extract sensitive information such as password, cvc, and cardnumber fields from forms. This extracted data i...

PT-2020-20971

Name of the Vulnerable Software and Affected Versions motiv.scss version 0.4.20 Description The issue concerns malicious code in a specific version of motiv.scss. When executed in a browser, this code can extract sensitive information such as password, cvc, and cardnumber fields from forms and se...

PT-2020-21042

Name of the Vulnerable Software and Affected Versions angular-location-update version 0.0.3 Description The issue concerns malicious code in version 0.0.3 of angular-location-update. When executed in a browser, this code enumerates password, cvc, and cardnumber fields from forms and sends the...

PT-2020-21431

Name of the Vulnerable Software and Affected Versions scroool version 0.1.7 Description The issue concerns malicious code in version 0.1.7 of scroool that, when executed in a browser, extracts sensitive information such as password, cvc, and cardnumber fields from forms and sends this data to the...

PT-2020-21153

Name of the Vulnerable Software and Affected Versions diagram-js versions prior to 3.3.1 diagram-js versions prior to 2.6.2 Description The issue concerns the failure to escape output of user-controlled input in the search-pad, allowing attackers to execute arbitrary JavaScript, which can lead to...

@acanto/october-scripts (3.2.2), @acanto/workflow (5.1.0) +332 more potentially affected by CVE-2020-7733 via ua-parser-js (>=0.6.2, <=0.7.21)

ua-parser-js NPM version =0.6.2, =0.16.9, =2018.7.11-0, =2.0.1, =1.0.0-beta.11, =2.0.0-beta.1, =1.0.0, =5.0.0, =2.6.6, =6.6.0, =3.0.1, =0.1.3, =0.3.8 - @chessboard/nwb 0.25.3-next.0 and more Source cves: CVE-2020-7733 Source advisory: SNYK:JS-UAPARSERJS-610226...

Regular Expression Denial of Service (ReDoS)

Overview ua-parser-js is a lightweight JavaScript-based user-agent string parser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA. POC by Yeting Li var blank = " "; for let i = 1; i 5000; i++ blank...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by unknown CVE via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves: unknown CVE...

Malicious Package in 1337qq-js

All versions of 1337qq-js contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes: - Environment variables - Running processes - /etc/hosts - uname -a - npmrc file Recommendation Remove the packag...