@cimpress/simple-auth-wrapper (>=3.0.0, <=6.4.6), @p2/core (>=1.2.0-alpha.0, <=1.2.0) +7 more potentially affected by CVE-2018-7307 via auth0-js (>=9.0.0, <=9.2.2)

auth0-js NPM version =9.0.0, =3.0.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.2.0-alpha.0, =1.3.47, =11.0.0-beta.2, =1.3.0, =1.3.2 - olymp-auth 20.1.42 Source cves: CVE-2018-7307 Source advisory: OSV:GHSA-WPQ7-Q8J4-72JG...

Cross-site Request Forgery (CSRF)

auth0-js is vulnerable to cross-site request forgery CSRF attacks. These attacks are possible if the state parameter is missing in an authorization response...

CVE-2018-6529

XSS vulnerability in htdocs/webinc/js/bscsmsinbox.php in D-Link DIR-868L DIR868LA1FW112b04 and previous versions, DIR-865L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and previous versions allows remote attackers to read a cookie via a crafted Treturn...

Design/Logic Flaw

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter...

CVE-2018-7307

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter...

CVE-2018-7307

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter...

CVE-2018-7307

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter...

CVE-2018-7307

Auth0.js (Auth0.js library) is affected up to and including version 9.3, where CSRF can occur if the authorization response lacks the state parameter. Root cause: improper handling of missing state in the response. Impact: CSRF vulnerability with high CVSS3 score (8.8) and notable risks of unauth...

CVE-2018-7307: Cross-Site Request Forgery (CSRF)

The Auth0 Auth0.js library before 9.3 has CSRF because it mishandles the case where the authorization response lacks the state parameter...

PT-2018-18013

Name of the Vulnerable Software and Affected Versions Auth0.js versions prior to 9.3 Description The issue arises from the mishandling of authorization responses that lack the state parameter, allowing an attacker to bypass the CSRF check. This enables the attacker to perform CSRF attacks on the...

JS Autoz ,1.0.9,SQL Injection

JS Autoz by Joomsky.com, 1.0.9 and previous, SQL Injection...

IE11: Use-after-free in Js::RegexHelper::RegexReplace(CVE-2018-0866)

There is a Use-after-free vulnerability in Internet Explorer that could potentially be used for memory disclosure. This was tested on IE11 running on Window 7 64-bit with the latest patches applied. Note that the PoC was tested in a 64-bit tab process via TabProcGrowth=0 registry flag and the pag...

JS Jobs, 1.1.9, SQL Injection

JS Jobs by Joomsky, versions 1.1.9 and previous, SQL injection resolution: update to version 1.2.0 update notice: http://www.joomsky.com/products/js-jobs.html...

Sql injection

SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a viewresume request...

Sql injection

SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter...

CVE-2018-5994

SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a viewresume request...

CVE-2018-6006

SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter...

CVE-2018-6006

The CVE-2018-6006 entry concerns a SQL Injection in the Joomla! extension JS Autoz (version 1.0.9) via the vtype, pre, or prs parameters. Vulnerable component: JS Autoz 1.0.9 for Joomla!, with root cause described as input handling allowing SQL injection. Impact per CVSS metrics is high/critical ...

CVE-2018-5994

SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a viewresume request...

CVE-2018-5994

CVE-2018-5994 affects Joomla! JS Jobs 1.1.9. SQL Injection via the zipcode parameter in newest-jobs requests or the ta parameter in view_resume requests. Public exploitation is documented (exploit-db). No remediation or patch/version details are provided in the supplied documents. CVSSv3.0 base s...