217 matches found
EUVD-2022-1741
Malicious code in bioql PyPI...
EUVD-2022-0618
Malicious code in bioql PyPI...
EUVD-2024-2940
Malicious code in bioql PyPI...
EUVD-2025-26643
Malicious code in bioql PyPI...
CVE-2025-55748
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as...
Relative Path Traversal
Overview Affected versions of this package are vulnerable to Relative Path Traversal via the resource parameter in the jsx and sx endpoints. An attacker can access and read sensitive configuration files by crafting URLs with "../" sequence that traverse directories. Remediation Upgrade...
CVE-2025-55748 XWiki Platform's configuration files can be accessed through jsx and sx endpoints
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as...
CVE-2025-55748
Affected product : XWiki Platform. Vulnerability : path traversal through the jsx and sx endpoints that allows remote attackers to read configuration files. Root cause : improper access control enabling traversal to read files like WEB-INF/xwiki.cfg. Versions affected : 4.2-milestone-2 through 16...
CVE-2025-55748: Relative Path Traversal
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as...
Linux Distros Unpatched Vulnerability : CVE-2024-21535
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting XSS via the src property due to improper input sanitization. An...
Malicious code in duo-jsx (npm)
The package duo-jsx was found to contain malicious code...
MAL-2025-18986 Malicious code in duo-jsx (npm)
The package duo-jsx was found to contain malicious code...
Malicious code in styled-jsx-plugin-sass-2 (npm)
The package styled-jsx-plugin-sass-2 was found to contain malicious code...
docusign-jsx (1.0.0), word-replace-contabil (>=1.0.1, <=1.0.9) potentially affected by unknown CVE via word2pdf (0.0.1-security)
word2pdf NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on word2pdf and may be impacted: - docusign-jsx 1.0.0 - word-replace-contabil =1.0.1, =1.0.9 Source cves: unknown CVE Source advisory: OSV:MAL-2025-39417...
MAL-2025-34122 Malicious code in styled-jsx-plugin-sass-2 (npm)
The package styled-jsx-plugin-sass-2 was found to contain malicious code...
CVE-2022-24821
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But ...
Cross Site Scripting
solid-js is vulnerable to Cross Site Scripting. The vulnerability is due to improper escaping of user input inside illegal inlined JSX fragments, allowing unescaped input to be rendered as HTML...
Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)
Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. For instance, ?text= would trigger XSS here. js const text = createResource = return new...
GHSA-3QXH-P7JC-5XH6 Solid Lacks Escaping of HTML in JSX Fragments allows for Cross-Site Scripting (XSS)
Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. For instance, ?text= would trigger XSS here. js const text = createResource = return new...
CVE-2025-27109
solid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has...