MAL-2025-32988 Malicious code in serenity-faz39-hvnww-ivy-project (npm)

The package serenity-faz39-hvnww-ivy-project was found to contain malicious code...

CVE-2024-26318

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character...

GHSA-5JJQ-8CVJ-V6M9 Cross-site Scripting in Serenity

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character...

Cross-site Scripting in Serenity

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character...

CVE-2024-26318

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character...

CVE-2024-26318

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character...

Cross site scripting

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character...

Serenity Security Breach

Serenity is Serenity Software open source an ASP.NET Core/TypeScript application platform . Designed to simplify and shorten the development of data-centric business applications through a service-based architecture . Serenity 6.8.0 prior to the version of a security vulnerability , the...

CVE-2024-26318

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character...

CVE-2024-26318

Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character...

CVE-2024-26318

Serenity CVE-2024-26318: In Serenity up to version 6.7.x, LoginPage.tsx allows return URLs not starting with a slash, which enables Cross‑Site Scripting via phishing/email links. The issue is described across multiple sources (Serenity release notes and Red Hat/Veracode advisories) as a client-si...

Malicious code in @serenity-web/common-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1958105778b66cb3d83e65931c92543bf2777f57632f516f4b592808317e4b95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11 Malicious code in @serenity-web/channel-motor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2e1f63ab01642f5ad7bc933a823db954af9d0880bc4ef256f32077a9b89b714 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-14 Malicious code in @serenity-web/components-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c85633dc6373fe7b73c4d82c80a69e7b0997938dc620a25e7c74df66cf91257 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @serenity-web/components-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c85633dc6373fe7b73c4d82c80a69e7b0997938dc620a25e7c74df66cf91257 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12 Malicious code in @serenity-web/common-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1958105778b66cb3d83e65931c92543bf2777f57632f516f4b592808317e4b95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-13 Malicious code in @serenity-web/common-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cca192112e75d572b4acfa46a40cbca00653059b1452b396d996396c27648ced Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @serenity-web/common-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cca192112e75d572b4acfa46a40cbca00653059b1452b396d996396c27648ced Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @serenity-web/channel-motor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2e1f63ab01642f5ad7bc933a823db954af9d0880bc4ef256f32077a9b89b714 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this user does not exist. Remediation...