XSS in Action View

There is a potential Cross-Site Scripting XSS vulnerability in Action View's translation helpers. Views that allow the user to control the default not found value of the t and translate helpers could be susceptible to XSS attacks. Impact When an HTML-unsafe string is passed as the default for a...

PT-2020-21960

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 4 crash has been reported. The crash involves the functions le to u32, le to i32, and bcf dec typed int1 safe. No information i...

Cross-site Scripting (XSS)

Overview actionview is a simple, battle-tested conventions and helpers for building web pages. Affected versions of this package are vulnerable to Cross-site Scripting XSS. Views that allow the user to control the default not found value of the t and translate helpers could be susceptible to XSS...

dom4j: XML External Entity vulnerability in default SAX parser

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

Prototype Pollution in safe-object2

All versions of safe-object2 are vulnerable to prototype pollution. The settter function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

GHSA-QCCF-Q7P4-3Q3J Prototype Pollution in safe-object2

All versions of safe-object2 are vulnerable to prototype pollution. The settter function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects. Recommendation No fix is currently available...

PT-2020-21457

Name of the Vulnerable Software and Affected Versions safe-object2 versions all Description The issue concerns prototype pollution, where the settter function fails to restrict modifications to an Object's prototype. This could allow an attacker to add or modify existing properties that will be...

Sandbox Breakout / Arbitrary Code Execution in safe-eval

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code. For example, the payload = const targetKey = Object.keysthis0; Object.definePropertythis,...

GHSA-9PCF-H8Q9-63F6 Sandbox Breakout / Arbitrary Code Execution in safe-eval

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code. For example, the payload = const targetKey = Object.keysthis0; Object.definePropertythis,...

@550w-tools/cli (>=0.0.14, <=0.0.16), @550w-tools/core (>=0.0.14, <=0.0.16) +539 more potentially affected by unknown CVE via safe-eval (>=0.2.0, <=0.4.1)

safe-eval NPM version =0.2.0, =0.0.14, =0.0.14, =0.0.13, =0.0.14, =0.0.15, =1.0.1, =1.0.2, =1.0.3, =1.1.2, =0.1.16-beta.1, =1.0.0-beta.4, =0.3.0-alpha.1, =0.20.0, =2.0.295, =2.0.315 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9PCF-H8Q9-63F6...

PT-2020-21201

Name of the Vulnerable Software and Affected Versions safe-eval versions all Description The issue allows for Sandbox Escape, leading to Remote Code Execution. It can be exploited using a payload that chains a function's callee and caller constructors to escape the sandbox and execute arbitrary...

CVE-2020-7726

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function...

CVE-2020-7726

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function...

CVE-2020-7726

CVE-2020-7726 corresponds to prototype pollution in the npm package safe-object2 via the setter function. Affected versions are stated as all versions; the vulnerability enables an attacker to inject properties into Object.prototype (e.g., proto , constructor, prototype), with potential DoS or re...

CVE-2020-7726

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function...

CVE-2020-7726: Improperly Controlled Modification of Object Prototype Attributes

All versions of package safe-object2 are vulnerable to Prototype Pollution via the setter function...

PT-2020-19747 · Unknown · Safe-Object2

Name of the Vulnerable Software and Affected Versions: safe-object2 versions affected versions not specified Description: The issue concerns Prototype Pollution via the setter function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...

dom4j: XML External Entity vulnerability in default SAX parser

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

GHSA-HRPQ-R399-WHGW Sandbox Breakout / Arbitrary Code Execution in safe-eval

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. Evaluating the payload js function var ex = new Error...

Sandbox Breakout / Arbitrary Code Execution in safe-eval

All versions of safe-eval are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. Evaluating the payload js function var ex = new Error...