CVE-2023-45133 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that re...

CVE-2023-45133

CVE-2023-45133 affects Babel’s traversal layer. The issue allows arbitrary code execution during compilation when compiling code crafted by an attacker via plugins that rely on path.evaluate() or path.evaluateTruthy(). Affected in: @babel/traverse prior to 7.23.2 and 8.0.0-alpha.4, and all versio...

RUSTSEC-2023-0089 atomic-polyfill is unmaintained

The author has archived the GitHub repository and mentions deprecation in project's README. Possible alternatives portable-atomic...

CVE-2023-26487 Vega has cross-site scripting vulnerability in `lassoAppend` function

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.lassoAppend' function accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as push call argument...

MAL-2022-5765 Malicious code in resize-obsever-pulyfjll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ecad73c257b6414fec8cc651d7b3f4b6c6eb420c0ac9259ad3440f7d56276dd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1410 Malicious code in babel-polyflil (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57b2120c7b63984c45bd58de106a3c587c633e67611bfa38bc9498e8decf1f77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2717 Malicious code in ember-getowner-polyfill.import (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de299415a84d24c99737d1dc90038b9ef5bf3e02dec1af6e1308fc486f1d4c69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sanitizer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f859078e9749efb809bdbd5790a5631e1ef3f36a0c70f51d8edd19e63990146c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5930 Malicious code in sanitizer-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f859078e9749efb809bdbd5790a5631e1ef3f36a0c70f51d8edd19e63990146c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in core-asynciterator-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27d2c0bbc023c14bd6c8dbda0ceffc3fa89a3ac203e97118da7ac589134cd7c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2189 Malicious code in core-asynciterator-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27d2c0bbc023c14bd6c8dbda0ceffc3fa89a3ac203e97118da7ac589134cd7c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dynamic-load-sticky-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cae02f392cd1bcfcc0c014ee7fed7a90f615a4fb38ab23b0e73d06f33c72d84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2636 Malicious code in dynamic-load-sticky-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cae02f392cd1bcfcc0c014ee7fed7a90f615a4fb38ab23b0e73d06f33c72d84 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[Security Nation] Kate Stewart on Open-Source Projects at the Linux Foundation

!\Security Nation\ Kate Stewart on Open-Source Projects at the Linux Foundationhttps://blog.rapid7.com/content/images/2022/04/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod chat with Kate Stewart, VP of Dependable Embedded Systems at the Linux Foundation, about the...

Undesired Behavior

Overview event-source-polyfill is an A polyfill for http://www.w3.org/TR/eventsource/ Affected versions of this package are vulnerable to Undesired Behavior. This package geo-locates users based on their IP address and if the user is Russia-based prints a political protest message in the browser ...

Security update for nextcloud (important)

openSUSE Security Update: Security update for nextcloud Announcement ID: openSUSE-SU-2021:1253-1 Rating: important References: 1190291 Cross-References: CVE-2021-32766 CVE-2021-32800 CVE-2021-32801 CVE-2021-32802 CVSS scores: CVE-2021-32800 NVD : 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N...

Fedora Update for php-brumann-polyfill-unserialize FEDORA-2019-af7bef7165

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 29 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-af7bef7165)

Two security updates have been released for PharStreamWrapper. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 30 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-a8121923d5)

Two security updates have been released for PharStreamWrapper. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Cross-site Scripting (XSS)

polyfill-service is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary JavaScript through the unknown policy parameter...