SUSE CVE-2019-18797

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operatorSass::BinaryExpression in eval.cpp...

SUSE CVE-2019-18798

LibSass before 3.6.3 allows a heap-based buffer over-read in Sass::weaveParents in astselweave.cpp...

node-sass-with-bindings (>=4.5.5, <=4.5.6) potentially affected by CVE-2022-25895 via lite-dev-server (3.2.7)

lite-dev-server NPM version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on lite-dev-server and may be impacted: - node-sass-with-bindings =4.5.5, =4.5.6 Source cves: CVE-2022-25895 Source advisory: OSV:GHSA-PPPV-CH8P-RP2W...

node-sass-with-bindings (>=4.5.5, <=4.5.6) potentially affected by CVE-2022-25895 via lite-dev-server (3.2.7)

lite-dev-server NPM version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on lite-dev-server and may be impacted: - node-sass-with-bindings =4.5.5, =4.5.6 Source cves: CVE-2022-25895 Source advisory: SNYK:JS-LITEDEVSERVER-3153718...

OSV-2022-896 Segv on unknown address in Sass::unifyComplex

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=51316 Crash type: Segv on unknown address Crash state: Sass::unifyComplex Sass::Extender::extendCompound Sass::Extender::extendComplex...

PT-2022-37280 · Sass · Sass

Name of the Vulnerable Software and Affected Versions: Sass affected versions not specified Description: The issue is related to a crash in the Sass software, specifically a segmentation fault on an unknown address. The crash occurs in the Sass::unifyComplex function, which is called by...

Malicious code in sass-loadre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb51edea624a3e91103abc49a51dd9751f229edb78a32272995972dd71e8927c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sass-lwadeoq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070ed3c51e690c8f6dcac18d9d5f8c0ede1571962b934611ac0d1c6d35e3f0f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5933 Malicious code in sass-loadre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb51edea624a3e91103abc49a51dd9751f229edb78a32272995972dd71e8927c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5934 Malicious code in sass-lwadeoq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070ed3c51e690c8f6dcac18d9d5f8c0ede1571962b934611ac0d1c6d35e3f0f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-22359

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

Cross site request forgery (csrf)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

Xxe

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 220651...

Server side request forgery (ssrf)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force...

CVE-2022-22359

CVE-2022-22359 affects IBM Sterling Partner Engagement Manager (Essentials/Standard editions 6.1.2, 6.2; Cloud/SaaS 22.2). Root cause: a cross-site request forgery (CSRF) flaw stemming from insufficient validation of a user request parameter, enabling an attacker to perform malicious actions on b...

CVE-2022-22359: Cross-Site Request Forgery (CSRF)

IBM Sterling Partner Engagement Manager 6.1.2, 6.2, and Cloud/SasS 22.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 220652...

CVE-2022-25758

All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service ReDoS via the loadAnnotation function, due to the usage of insecure regex...

Malicious code in gd-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd9e91f4618495cc4c59d76f8f4126c06c74a3966d97546edc9c7a8d5dbf857b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3315 Malicious code in gd-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd9e91f4618495cc4c59d76f8f4126c06c74a3966d97546edc9c7a8d5dbf857b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-with-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0946d8ce554c4342a4ca8846ecb6a66703712bbf720809ce3fdfade36925b648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...