cypress-ct-jordan-qwik (>=0.0.0-alpha-9 <=0.0.0-alpha-12), storybook-framework-qwik (=0.0.1) potentially affected by CVE-2023-1283 via @builder.io/qwik (>=0.15.2 <=0.18.1)

@builder.io/qwik NPM version =0.15.2, =0.0.0-alpha-9, =0.0.0-alpha-12 - storybook-framework-qwik =0.0.1 Source cves: CVE-2023-1283 Source advisory: OSV:GHSA-9WF9-QVVP-2929...

CVE-2023-1283

Code Injection in GitHub repository builderio/qwik prior to 0.21.0...

Code injection

Code Injection in GitHub repository builderio/qwik prior to 0.21.0...

CVE-2023-1283 Code Injection in builderio/qwik

Code Injection in GitHub repository builderio/qwik prior to 0.21.0...

qwik 代码注入漏洞

qwik is a micro web framework. A code injection vulnerability exists in versions prior to qwik 0.21.0. An attacker could exploit this vulnerability to perform a code injection attack...

CVE-2023-1283 Code Injection in builderio/qwik

Code Injection in GitHub repository builderio/qwik prior to 0.21.0...

CVE-2023-1283 Code Injection in builderio/qwik

Code Injection in GitHub repository builderio/qwik prior to 0.21.0...

CVE-2023-1283

CVE-2023-1283 affects builderio/qwik versions prior to 0.21.0. The vulnerability arises from the deserializer exposed via the pureServerFunction feature, enabling an unauthenticated attacker to inject and run arbitrary JavaScript code (via a crafted request to /q-data.json). Impact is code execut...

RCE using bad deserialization

Description Qwik provides an extended serialization mechanism for exchanging data between the client and server. This allows for the serialization and deserialization of Date, Regex, Signal, Function and many other useful data types. The Function deserializer can be accessed using the...

Cross-Site Scripting (XSS)

@builder.io/qwik is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to improper sanitization of user inputs in render-ssr.ts, which allows an attacker to inject and execute arbitrary JavaScript...

storybook-framework-qwik (=0.0.1) potentially affected by CVE-2023-0410 via @builder.io/qwik (=0.15.2)

@builder.io/qwik NPM version =0.15.2 is affected by a known vulnerability. The following packages have a transitive dependency on @builder.io/qwik and may be impacted: - storybook-framework-qwik =0.0.1 Source cves: CVE-2023-0410 Source advisory: OSV:GHSA-HM7F-RQ7Q-J9XP...

@builder.io/qwik vulnerable to Cross-site Scripting

@builder.io/qwik prior to version 0.16.2 is vulnerable to cross-site scripting due to attribute names and the class attribute values not being properly handled...

CVE-2023-0410

Cross-site Scripting XSS - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5...

PT-2023-16248

Name of the Vulnerable Software and Affected Versions @builder.io/qwik versions prior to 0.16.2 @builder.io/qwik versions prior to 0.1.0-beta5 Description The issue is related to Cross-site Scripting XSS due to improper handling of attribute names and the class attribute values. Recommendations F...

CVE-2023-0410

CVE-2023-0410 affects builder.io/qwik prior to 0.1.0-beta5. The vulnerability is a Cross-site Scripting (XSS) issue caused by improper sanitization in render-ssr.ts, enabling injection and execution of arbitrary JavaScript. Multiple sources (NVD/Red Hat/OSV/Veracode/GHSA) confirm the same vector ...

CVE-2023-0410 Cross-site Scripting (XSS) - Generic in builderio/qwik

Cross-site Scripting XSS - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5...

qwik 跨站脚本漏洞

qwik is a micro web framework. A cross-site scripting vulnerability exists in versions prior to qwik 0.1.0-beta5. No information about this vulnerability is available at this time, please stay tuned to CNNVD or vendor announcements...

CVE-2023-0410 Cross-site Scripting (XSS) - Generic in builderio/qwik

Cross-site Scripting XSS - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5...

CVE-2023-0410 Cross-site Scripting (XSS) - Generic in builderio/qwik

Cross-site Scripting XSS - Generic in GitHub repository builderio/qwik prior to 0.1.0-beta5...

Attributes are not properly handled leading to XSS

Description Attribute names and the class attribute values are not properly handled leading to XSS where a user can control either: + A class value + An attribute name. While this may not seem like a important security issue this weakness is not documented. One would assume the behaviour would...