5997 matches found
CVE-2019-7967
Technical details for CVE-2019-7967 are not provided in the connected documents. The entry remains reserved/no public details here. Monitor for updates as information may be released later.
CVE-2017-16087
The connected advisories describe a vulnerability in the npm package fs-git where strings passed to the buildCommand method are not sanitized, allowing arbitrary code execution. Affected versions of fs-git do not sanitize inputs, enabling code execution via crafted input in buildCommand. The issu...
CVE-2016-1000226
The connected advisory GHSA-7F59-X49P-V8MQ documents a Cross-Site Scripting vulnerability in swagger-ui. Affected versions of swagger-ui are vulnerable to XSS in both the consumes and produces parameters of the swagger JSON document for a given API. Additionally, an attacker can trick users into ...
CVE-2016-1000235
Vulnerability context (CVE-2016-1000235 / FuelUX) A cross-site scripting flaw affects the FuelUX library’s Pillbox feature. By supplying a script as the value for a new pillbox, an attacker can achieve arbitrary script execution. Affected versions are stated as vulnerable; no exact version range ...
CVE-2014-8881
Summary: The connected advisories indicate a Regular Expression Denial of Service (ReDoS) affecting all versions of the Python package bleach during its sanitize function. The issue is not tied to a specific version release in the provided documents; the advisories state all versions are vulnerab...
CVE-2013-3364
CVE-2013-3364 aligns with a GitHub advisory and OSV entry describing unauthenticated remote command injection in the ep_imageconvert plugin for Etherpad Lite. The vulnerability affects ep_imageconvert
CVE-2016-1000223
The CVE entry CVE-2016-1000223 has no public details in the Initial document. Connected documents reveal a vulnerability in the jws package (GitHub advisory GHSA-GJCW-V447-2W7Q / OSV entry) where users can select the JWT verification algorithm, allowing a malicious actor to modify a JWT while sti...
CVE-2016-1000238
The CVE-2016-1000238 entry is linked to node-krb5 SPOOFING via unvalidated KDC. Affected: node-krb5 (Node.js module). Issue: KDC is not validated before authentication, allowing a network-attacker with time and access to spoof the KDC and impersonate a valid user without credentials. Impact: pote...
CVE-2014-8883
The relevant advisories describe a directory traversal vulnerability in the nhouston static file server module, affecting all versions. An attacker can supply traversal input (e.g., ../) to read files outside the served directory. This VHS is documented in GHSA-44G9-W23C-5RW7 and mirrored in OSV ...
CVE-2016-1000224
The connected advisories describe a vulnerability in ezseed-transmission: affected versions download/run a script over HTTP, enabling a privileged-network attacker to perform a Man‑in‑the‑Middle attack and replace the script with malicious code, compromising the system running ezseed-transmission...
CVE-2015-7982
Vulnerability details found: The gm library (Node.js wrapper) versions prior to 1.21.1 are affected by a command-injection flaw. The issue occurs when user input is passed to gm.compare() without proper sanitization before invoking the GraphicsMagick binary. Remediation: update to version 1.21.1 ...
CVE-2016-1000241
The CVE entry (CVE-2016-1000241) is linked to a known XSS vulnerability in pivottable. Affected software: pivottable (JavaScript library). Issue: a new rendering mechanism for JSON elements introduces cross-site scripting, enabling injection through JSON-rendered content. References from connecte...
CVE-2017-16034
The CVE-2017-16034 entry maps to a real vulnerability in the Node.js pidusage package: affected versions pass unsanitized input to child_process.exec(), allowing arbitrary code execution in the ps method. The PoC is viable on Darwin, SunOS, FreeBSD, and AIX; Windows and Linux are not affected. Re...
CVE-2016-1000234
The CVE-2016-1000234 entry maps to a Cross-Site Scripting issue in the jqTree component. Connected advisories (GHSA-GJHX-GXWX-JX9J and OSV) describe that affected versions of jqtree are vulnerable to XSS via the drag-and-drop operation when modifying tree data, allowing script content within a no...
CVE-2016-1000240
The connected advisories identify a Cross-Site Scripting (XSS) vulnerability in the c3 JavaScript charting library. Affected versions are vulnerable to XSS due to improper sanitization of HTML in rendered tooltips. The issue is documented in GHSA-GVG7-PP82-CFF3 and mirrored in OSV and npm advisor...
CVE-2014-4179
The CVE-2014-4179 entry is linked to a denial-of-service issue in the yar library. Affected software: yar prior to 2.2.0. Root cause: invalid encrypted session cookie value causes the process to crash, leading to DoS. Impact: service disruption; no exploitation details provided in the documents. ...
CVE-2016-1000231
The CVE placeholder CVE-2016-1000231 is linked to a real issue in the emoji rendering library emojione. Affected versions are vulnerable to cross-site scripting (XSS) when user input is fed into functions such as toShort(), shortnameToImage(), unicodeToImage(), and toImage(). The root cause is im...
CVE-2014-8882
The connected advisories identify a Regular Expression Denial of Service in the validator library’s isURL method affecting versions prior to 3.22.1; remediation is to update to 3.22.1 or later (GHSA-f5w6-r7rg-mcgq, OSV GHSA, and NODEJS advisory 42 reference validator.js). No exploitation details ...