CVE-2020-12404

For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS 26...

CVE-2020-12404

For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS 26...

PT-2020-13103

Name of the Vulnerable Software and Affected Versions Firefox for iOS versions prior to 26 Description The issue arises from the native-to-JS bridging mechanism in the app, which requires a unique token to prevent non-app code from calling bridging functions. However, this token can potentially...

CVE-2020-12404: Improper Neutralization of Input During Web Page Generation

For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS 26...

Exploit for Improper Handling of Exceptional Conditions in Sockjs_Project Sockjs

CVE-2020-7693: Meteor A demo Meteor app running the vuln...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2020-8176

CVE-2020-8176 affects koa-shopify-auth, versions 3.1.61–3.1.62. The vulnerability is an XSS via the shop parameter in /shopify/auth/enable_cookies. Root cause cited across sources is lack of sanitization of the shop value in multiple files (e.g., auth/client/request-storage-access.ts, auth/client...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

Prototype Pollution

Overview Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to...

Shopify: xss on polaris.shopify.com/demo using postMessage

Description it's possible to run arbitrary js code using https://polaris.shopify.com/demo + postMessage following codes are from this file which formatted using prettier Demo component line 381 uses addEventListener to listen for message events line 401: js componentDidMount...

PT-2020-6419

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an assertion in the parser parse object initializer function in the js-parser-expr.c component of the JerryScript JavaScript engine for the Internet of Things. This assertion is...

PT-2020-6417

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an assertion in the parser parse function arguments function in JerryScript, specifically in the js-parser.c component. This assertion is context p-next scanner info p-type == SCANN...

JSC JIT Out-Of-Bounds Access Vulnerability

The DFG and FTL JIT compilers incorrectly replace Checked with Unchecked ArithNegate operations and vice versa during Common Subexpression Elimination. This can then be exploited to cause out-of-bounds accesses and potentially other memory safety violations. JSC: JIT: Incorrect Common Subexpressi...

PT-2020-6416

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an assertion in the parser emit cbc backward branch function in the js-parser-util.c component of the JerryScript engine for the Internet of Things. This assertion is 'flags CBC STA...

KLA11793 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in SharedWorkerService can b...

PT-2020-6412

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an incorrect comparison in the parser parse object initializer function of the js-parser-expr.c component in JerryScript. This could potentially allow a remote attacker to cause a...

PT-2020-6414

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to the scanner literal is created function in the js-scanner-util.c component of the JerryScript JavaScript engine for Internet of Things IoT. It is caused by insufficient use of the...

PT-2020-6413

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to the parser parse source function in the js-parser.c component of the JerryScript JavaScript engine for Internet of Things IoT devices. It involves an assertion failure, specifically...

PT-2020-6411

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to an incorrect comparison in the parser parse function statement function of the js-parser-statm.c component in the JerryScript JavaScript engine for the Internet of Things. This can...

PT-2020-6415

Name of the Vulnerable Software and Affected Versions JerryScript version 2.2.0 Description The issue is related to the parser parse try statement end function in the js-parser-statm.c component of the JerryScript JavaScript engine for the Internet of Things. It involves an insufficient use of th...