109 matches found
CVE-2023-48183
QuickJS before c4cdd61 has a buildforiniterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval...
CVE-2023-48183
CVE-2023-48183 affects QuickJS prior to commit c4cdd61. The vulnerability stems from an erroneous lexical scope of the value of this with eval, causing a NULL pointer dereference in build_for_in_iterator. Documented impact includes possible crashes/denial of service and potential arbitrary code e...
CVE-2023-48183
QuickJS before c4cdd61 has a buildforiniterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval...
QuickJS 安全漏洞
QuickJS is a small and embeddable Javascript engine. A security vulnerability exists in versions of QuickJS prior to c4cdd61, which stems from a lexical scoping error in this with eval, resulting in a null pointer dereference vulnerability...
CVE-2023-48183
QuickJS before c4cdd61 has a buildforiniterator NULL pointer dereference because of an erroneous lexical scope of "this" with eval...
Multiple soundness issues in lexical
lexical contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls MaybeUninit::assumeinit ...
GHSA-C2HM-MJXV-89R4 Multiple soundness issues in lexical
lexical contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls MaybeUninit::assumeinit ...
RUSTSEC-2023-0055 Multiple soundness issues
lexical contains multiple soundness issues: 1. Bytes::read allows creating instances of types with invalid bit patterns 1. BytesIter::read advances iterators out of bounds 1. The BytesIter trait has safety invariants but is public and not marked unsafe 1. writefloat calls MaybeUninit::assumeinit ...
CVE-2023-30792
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources...
CVE-2023-30792
Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources...
CVE-2023-30792
The CVE-2023-30792 issue affects Meta Platforms Lexical versions prior to 0.10.0, where anchor tag hrefs render javascript: URLs when parsing input from untrusted sources, enabling cross-site scripting on link clicks. The vulnerability stems from unsanitized hrefs in anchor elements (createDOM pa...
PT-2023-22985 · Lexical · Lexical
Name of the Vulnerable Software and Affected Versions: Lexical versions prior to 0.10.0 Description: The issue allows cross-site scripting on link clicks when input is being parsed from untrusted sources, due to href attributes in anchor tags rendering javascript: URLs. Recommendations: For...
Meta Platforms Lexical 跨站脚本漏洞
Meta Platforms Lexical is an extensible JavaScript web text editor framework from Meta Platforms, Inc. A security vulnerability exists in Meta Platforms Lexical versions prior to v0.10.0 that originates from allowing cross-site scripting attacks on link clicks while parsing input from an untruste...
payload-cloudinary-plugin (0.0.10), payload-plugin-lexical (>=0.0.19, <=0.0.21) potentially affected by CVE-2023-30843 via payload (>=1.1.26, <=1.6.26)
payload NPM version =1.1.26, =0.0.19, =0.0.21 Source cves: CVE-2023-30843 Source advisory: OSV:GHSA-35JJ-VQCF-F2JF...
PicoC 缓冲区错误漏洞
PicoC is a lightweight C interpreter. A buffer error vulnerability exists in PicoC version 3.2.2, which stems from a heap buffer overflow contained in the LexSkipComment function in lex.c when LexScanGetToken is called...
The vulnerability of the sql_lex.cc component of the MariaDB database, which allows a hacker to cause a service failure.
The vulnerability of the sqllex.cc component of the MariaDB database is related to integer overflow. Exploiting this vulnerability allows an attacker to cause service failures...
[SECURITY] Fedora 35 Update: golang-starlark-0-0.7.20210113gite81fc95.fc35
Starlark is a dialect of Python intended for use as a configuration language. Like Python, it is an untyped dynamic language with high-level data types, first-class functions with lexical scope, and garbage collection. Unlike CPython, independent Starlark threads execute in parallel, so Starlark...
Malicious Package
Overview lexical-website-new is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...
Malicious code in lexical-monorepo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af686331feed45b8818ceff08372677fb1f0f5531b48057d994aa8d3e871fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4290 Malicious code in lexical-monorepo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af686331feed45b8818ceff08372677fb1f0f5531b48057d994aa8d3e871fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...