CVE-2020-24025: Improper Certificate Validation

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path...

Sass Node-sass Trust Management Issues Vulnerability

Sass Node-sass is a C++-based codebase from the Gogo Sass team that supports Node interaction with LibSass. A security vulnerability exists in node-sass 2.0.0 to 4.14.1, which stems from certificate validation being disabled...

sass-ag.de Cross Site Scripting vulnerability OBB-1337093

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Denial of Service in node-sass

Affected versions of node-sass are vulnerable to Denial of Service DoS. Crafted objects passed to the renderSync function may trigger C++ assertions in CustomImporterBridge::getimporterentry and CustomImporterBridge::postprocessreturnvalue that crash the Node process. This may allow attackers to...

08cms (1.0.0), 192.168.0.172 (4.6.1) +3407 more potentially affected by unknown CVE via node-sass (>=3.3.0, <=4.13.0)

node-sass NPM version =3.3.0, =1.0.3, =1.0.0-alpha.8, =0.1.0, =1.0.0, =0.6.2, =1.1.0, =0.0.1, =7.0.1, =0.6.0-private.6, =0.6.0-private.8 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9V62-24CR-58CX...

GHSA-9V62-24CR-58CX Denial of Service in node-sass

Affected versions of node-sass are vulnerable to Denial of Service DoS. Crafted objects passed to the renderSync function may trigger C++ assertions in CustomImporterBridge::getimporterentry and CustomImporterBridge::postprocessreturnvalue that crash the Node process. This may allow attackers to...

PT-2020-21211

Name of the Vulnerable Software and Affected Versions node-sass versions prior to 4.13.1 Description The issue allows attackers to crash the system's running Node process, leading to Denial of Service. This can be achieved by passing crafted objects to the renderSync function, which may trigger C...

GHSA-72Q2-5RXX-XFFF gfe-sass downloads Resources over HTTP

Affected versions of gfe-sass insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syste...

gfe (1.1.0) potentially affected by CVE-2017-16040 via gfe-sass (1.0.19)

gfe-sass NPM version 1.0.19 is affected by a known vulnerability. The following packages have a transitive dependency on gfe-sass and may be impacted: - gfe 1.1.0 Source cves: CVE-2017-16040 Source advisory: OSV:GHSA-72Q2-5RXX-XFFF...

gfe-sass downloads Resources over HTTP

Affected versions of gfe-sass insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syste...

OSV-2020-1486 Bad-cast to Sass::PreValue from Sass::Unary_Expression

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15896 Crash type: Bad-cast Crash state: Bad-cast to Sass::PreValue from Sass::UnaryExpression Sass::SharedImpl::SharedImpl Sass::Parser::parsevalueschema...

PT-2020-21865

Name of the Vulnerable Software and Affected Versions Sass affected versions not specified Description The issue is related to a bad-cast in the Sass parser, specifically when parsing IE keyword arguments. The crash occurs due to an incorrect cast from Sass::Unary Expression to Sass::PreValue. Th...

OSV-2020-1311 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring Sass::Prelexer::staticcomponent char const Sass::Prelexer::zeroplus&...

OSV-2020-1298 Heap-buffer-overflow in char const* Sass::Prelexer::alternatives<&

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: char const Sass::Prelexer::alternatives& char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1229 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::alternatives& char const Sass::Prelexer::sequence&...

OSV-2020-1206 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::nongreedy& Sass::Parser::lookaheadforvalue...

OSV-2020-1108 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::alternatives& Sass::Prelexer::cssvariabletoplevelvalue...

OSV-2020-1101 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Parser::lex& Sass::Parser::parsevalue...

OSV-2020-1037 Heap-buffer-overflow in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Heap-buffer-overflow READ 1 Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::sequence& char const Sass::Prelexer::alternatives&...

OSV-2020-1020 Use-of-uninitialized-value in Sass::Prelexer::quoted_string

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15890 Crash type: Use-of-uninitialized-value Crash state: Sass::Prelexer::quotedstring char const Sass::Prelexer::sequence& char const Sass::Prelexer::alternatives&...