PT-2018-6068

Name of the Vulnerable Software and Affected Versions: gfe-sass versions affected versions not specified Description: The gfe-sass library downloads resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. This could potentially lead to remote code execution RCE if an attacke...

PT-2018-10753

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.5 Description An issue was discovered in the function Sass::Prelexer::skip over scopes, which could allow an attacker to disclose information or cause a denial of service due to an out-of-bounds read of a memory...

PT-2018-10757

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.5 Description An issue was discovered in the function Sass::Prelexer::exactly that could allow an attacker to disclose information or cause a denial of service due to an out-of-bounds read of a memory region...

PT-2018-10755

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.3 Description A NULL pointer dereference was found in the Sass::Expand::operator function, which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other...

CVE-2017-16040: Missing Encryption of Sensitive Data

gfe-sass is a library for promises CommonJS/Promises/A,B,D gfe-sass downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

CVE-2018-11698: Out-of-bounds Read

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handleerror which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service...

CVE-2018-11697: Out-of-bounds Read

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service...

CVE-2016-10660: Missing Encryption of Sensitive Data

fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker...

CVE-2016-10686: Missing Encryption of Sensitive Data

fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the attacker is on the...

LibSaas Null Pointer Dereference Vulnerability

LibSaas is a C/C++ implementation of the Sass compiler. A null pointer dereference vulnerability exists in the Sass::Inspect::operator function in LibSaas 3.5.4 and earlier. An attacker could exploit this vulnerability to cause a denial of service application crash or possibly other impact...

PT-2018-10756

Name of the Vulnerable Software and Affected Versions LibSass versions prior to 3.5.5 Description A NULL pointer dereference was found in the function Sass::Inspect::operator, which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other...

CVE-2018-11693: Out-of-bounds Read

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skipoverscopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service...

CVE-2018-11696: NULL Pointer Dereference

An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::operator which could be leveraged by an attacker to cause a denial of service application crash or possibly have unspecified other impact...

LibSaas null pointer dereference vulnerability (CNVD-2018-15182)

LibSaas is a C/C++ implementation of the Sass compiler. A null pointer dereference vulnerability exists in the Sass::Expand::operator function in LibSaas 3.5.2 and earlier. An attacker could exploit this vulnerability to cause a denial of service application crash or possibly other impact...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

Remote code execution

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10595

jdf-sass is a fork from node-sass, jdf use only. jdf-sass downloads executable resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested file with an attacker controlled file if the attacker is on the netwo...

CVE-2016-10595

The CVE-2016-10595 issue affects the jdf-sass package, a fork of node-sass, which downloads resources over HTTP. The underlying root cause is unencrypted HTTP transfers allowing an attacker with a privileged network position to MITM the responses and swap in a malicious executable, potentially le...

PT-2018-4773

Name of the Vulnerable Software and Affected Versions jdf-sass versions affected versions not specified Description The issue arises from jdf-sass downloading executable resources over HTTP, making it susceptible to Man-In-The-Middle MITM attacks. This could potentially lead to remote code...