160 matches found
WordPress Amelia plugin <= 1.1.8 - Malicious Polyfill.io Embed vulnerability
Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Amelia versions = 1.1.8...
WordPress Weight Tracker plugin <= 10.9.1 - Malicious Polyfill.io Embed vulnerability
Malicious Polyfill.io Embed vulnerability discovered by Sansec.io in WordPress Plugin Weight Tracker versions = 10.9.1...
Examining the Polyfill Attack from Akamai's Point of View
...
Examining the Polyfill Attack from Akamai's Point of View
...
Polyfill Library Injected with Malware Impacting 100,000 Websites
A trusted JavaScript library, Polyfill.io, became a malware delivery system. Security experts exposed the attack and the potential consequences for website visitors. Learn how this supply chain attack highlights the importance of web development security and what steps developers can take to...
Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack
Google has taken steps to block ads for e-commerce sites that use the Polyfill.io service after a Chinese company acquired the domain and modified the JavaScript library "polyfill.js" to redirect users to malicious and scam sites. "Protecting our users is our top priority. We detected a security...
GHSA-5VGJ-GGM4-FG62 pdoc embeds link to malicious CDN if math mode is enabled
Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...
pdoc embeds link to malicious CDN if math mode is enabled
Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...
MAL-2024-921 Malicious code in npm_package_dependencies_promise_polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 812a88e649d4ae3319f178ec2ba4be3b92660d1887021d1525e1c46baa5618f6 The OpenSSF Package Analysis project identified 'npmpackagedependenciespromisepolyfill' @ 8.3.0 npm as malicious. It is considered malicious...
Malicious code in npm_package_dependencies_promise_polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 812a88e649d4ae3319f178ec2ba4be3b92660d1887021d1525e1c46baa5618f6 The OpenSSF Package Analysis project identified 'npmpackagedependenciespromisepolyfill' @ 8.3.0 npm as malicious. It is considered malicious...
SUSE CVE-2023-45133
Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...
Debian DSA-5528-1 : node-babel7 - security update
The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5528 advisory. - Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile...
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
Impact Using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluateor path.evaluateTruthy internal Babel methods. Known affected plugins are: - @babel/plugin-transform-runtime -...
UBUNTU-CVE-2023-45133
Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...
CVE-2023-45133
Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...
Code injection
Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...
CVE-2023-45133
CVE-2023-45133 affects Babel’s traversal layer. The issue allows arbitrary code execution during compilation when compiling code crafted by an attacker via plugins that rely on path.evaluate() or path.evaluateTruthy(). Affected in: @babel/traverse prior to 7.23.2 and 8.0.0-alpha.4, and all versio...
CVE-2023-45133 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...
a4 (>=0.0.1, <=0.0.4), a4-core (>=0.0.3, <=0.0.4) +979 more potentially affected by unknown CVE via atomic-polyfill (1.0.3)
atomic-polyfill CARGO version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on atomic-polyfill and may be impacted: - a4 =0.0.1, =0.0.3, =0.23.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.1, =0.5.2 and more Source cves: unknown...