CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

UBUNTU-CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

Summary: CVE-2020-7729 affects the grunt package due to insecure YAML loading via js-yaml in grunt.file.readYAML, allowing arbitrary code execution. The issue is triggered by using load() instead of safeLoad(). The vulnerability is discussed across multiple sources, including npm advisory, Ubuntu...

CVE-2020-7729 Arbitrary Code Execution

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load instead of its secure replacement safeLoad of the package js-yaml inside grunt.file.readYAML...

Denial Of Service (DoS)

serialize-to-js is vulnerable to denial of service DoS. The vulnerability exists as the unvalidated user input could cause an infinite loop in the deserialize function...

GHSA-48HW-37G6-3GW4 Malicious Package in mx-nested-menu

Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluat...

GHSA-GJC9-932X-C59P Malicious Package in leaflet-gpx

Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate yo...

Malicious Package in jekyll-for-github-projects

Version 0.2.12 of jekyll-for-github-projects contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment...

PT-2020-21070

Name of the Vulnerable Software and Affected Versions simple-crypto-js versions prior to 2.3.0 Description The issue concerns the use of AES-CBC with PKCS7 padding, which is susceptible to padding oracle attacks. This could potentially allow attackers to break the encryption and access sensitive...

PT-2020-20943

Name of the Vulnerable Software and Affected Versions rc cal version 0.1.1 Description The issue concerns malicious code in version 0.1.1 of rc cal. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the extracted values to...

PT-2020-21142

Name of the Vulnerable Software and Affected Versions pm-controls version 1.1.8 Description The issue concerns malicious code in a specific version of the software, which, when executed in a browser, can extract sensitive information such as password, cvc, and card number fields from forms. This...

PT-2020-21370

Name of the Vulnerable Software and Affected Versions iie-viz version 1.0.4 Description The issue concerns malicious code in version 1.0.4 of the iie-viz package. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends the...

PT-2020-21392

Name of the Vulnerable Software and Affected Versions sailclothjs version 1.2.6 Description The issue concerns malicious code in sailclothjs that, when executed in a browser, can extract sensitive information such as password, cvc, and cardnumber fields from forms. This extracted data is then sen...

PT-2020-21050

Name of the Vulnerable Software and Affected Versions device-mqtt version 1.0.11 Description The issue concerns malicious code in version 1.0.11 of the device-mqtt package. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and sends...

PT-2020-21150

Name of the Vulnerable Software and Affected Versions larvitbase-www versions affected versions not specified Description The issue concerns an Unintended Require in the package, which exposes an API endpoint. A GET parameter is passed unsanitized to a require call, allowing attackers to execute...

PT-2020-21335

Name of the Vulnerable Software and Affected Versions dmn-js-properties-panel versions prior to 0.8.0 Description The issue arises from the failure to sanitize input in specially configured diagrams, potentially allowing attackers to inject arbitrary JavaScript into the embedding website. This ca...

PT-2020-21402

Name of the Vulnerable Software and Affected Versions saml2-js versions prior to 2.0.5 Description The issue is related to an Authentication Bypass in the saml2-js package. It fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted...