39 matches found
EUVD-2021-0767
Malware in sbrugna...
EUVD-2021-0801
Malware in sbrugna...
EUVD-2023-1537
Malicious code in bioql PyPI...
CVE-2023-2583
Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3...
CVE-2020-8128
An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...
jsreport vulnerable to code injection
jsreport prior to 3.11.3 had a version of vm2 vulnerable to CVE-2023-29017 hard coded in the package.json of the jsreport-core component. An attacker can use this vulnerability to obtain the authority of the jsreport playground server, or construct a malicious webpage/html file and send it to the...
GHSA-G7RJ-Q722-245G jsreport vulnerable to code injection
jsreport prior to 3.11.3 had a version of vm2 vulnerable to CVE-2023-29017 hard coded in the package.json of the jsreport-core component. An attacker can use this vulnerability to obtain the authority of the jsreport playground server, or construct a malicious webpage/html file and send it to the...
CVE-2023-2583 Code Injection in jsreport/jsreport
Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3...
CVE-2023-2583 Code Injection in jsreport/jsreport
Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3...
CVE-2023-2583 Code Injection in jsreport/jsreport
Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3...
PT-2023-20335 · Vm2 +1 · Vm2 +1
Name of the Vulnerable Software and Affected Versions: jsreport versions prior to 3.11.3 Description: The issue is related to code injection in the jsreport GitHub repository. An attacker can exploit this to obtain authority over the jsreport playground server or construct a malicious webpage/htm...
CVE-2023-2583
CVE-2023-2583 affects jsreport/jsreport prior to 3.11.3. The root cause is a hardcoded vulnerable vm2 version in the jsreport-core package’s package.json, enabling code injection. Reported impact is code execution with high severity; in practice, exploitation appears tied to the vulnerable vm2 in...
jsreport 代码注入漏洞
jsreport is a report server that allows developers to define reports using javascript template engines such as handlebars. A code injection vulnerability exists in jsreport versions prior to 3.11.3. An attacker could exploit this vulnerability to perform a code injection attack...
An outdated dependency leads to to remote command execution vulnerability
Description A few days ago, the vm2 module of nodejs found a sandbox escape vulnerability, which was officially fixed in v3.9.15 However, a fixed vm2 version is hard-coded in the package.jsonv 3.9.11 of the jsreport-core component of jsreport, which makes it impossible to install the latest vm2...
Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...
GHSA-5FJJ-CFH2-GHC5 Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code...
jsreport-keycloak-auth (>=0.0.1, <=0.0.2) potentially affected by CVE-2020-8128 via jsreport (2.0.0)
jsreport NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on jsreport and may be impacted: - jsreport-keycloak-auth =0.0.1, =0.0.2 Source cves: CVE-2020-8128 Source advisory: OSV:GHSA-5FJJ-CFH2-GHC5...
@dfeidao/server (>=5.0.0, <=5.0.1), @mm-works/p000005 (>=1.0.202004231823, <=1.0.202004272011) +6 more potentially affected by CVE-2020-7762 via jsreport-chrome-pdf (>=1.0.0, <=1.9.0)
jsreport-chrome-pdf NPM version =1.0.0, =5.0.0, =1.0.202004231823, =1.0.202003051337, =1.6.2-patch.1, =2.0.0, =0.0.1, =0.0.2 - jsreport-worker 0.3.1 Source cves: CVE-2020-7762 Source advisory: OSV:GHSA-934W-HVJ4-7FR6...