666 matches found
RCE-NodeJs
node-serialize — CVE-2017-5941 Note: This document is for defense and educational purposes only. No instructions for creating exploits or RCE are included. Summary: node-serialize 0.0.4 and similar outdated versions may pose a risk due to untrusted deserialization — always validate input before...
cve-2017-5941-poc-docker-lab
CVE-2017-5941 — node-serialize Untrusted Deserialization RCE PoC ⚠️ For lab / self-assessment only. Use only on systems you own or are authorized to test. This repository provides: A minimal PoC script to reproduce CVE-2017-5941 against a vulnerable Node.js app that uses node-serialize = 0.0.4. Tw...
kernel: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture sound subsystem. A race condition between concurrent memory mapping operations and audio buffer reallocations allows memory pages to be released while still mapped as writable. A local user can exploit this vulnerabilit...
CLEANSTART-2026-CW86244 serialize-javascript prior to 3
Security vulnerability affects the argo-workflows package. serialize-javascript prior to 3...
Astra Linux – vulnerability in linux-6.1
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF sndpcmhwparams and sndpcmhwfree guard buffer reallocation by performing an mmapcount check under the PCM stream lock; however, the lock is released far too...
CLSA-2026-1793790235 TuxCare security update for serialize-javascript (2 CVEs)
TuxCare rebuilt serialize-javascript to address 2 CVEs. Fixed in 7.0.7-tuxcare.1...
CLSA-2026-1793789998 TuxCare security update for serialize-javascript (3 CVEs)
TuxCare rebuilt serialize-javascript to address 3 CVEs. Fixed in 3.0.0-tuxcare.1...
serialize-javascript: serialize-javascript: Cross-site scripting via unescaped function serialization
A flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct cross-site scripting XSS attacks by supplying crafted function source text containing unescaped script closing tags. When serialized into a web page, the malicious payload can prematurely close the enclosin...
serialize-javascript: serialize-javascript: Cross-Site Scripting via improper function escaping
A flaw was found in serialize-javascript. This vulnerability allows an attacker to conduct Cross-Site Scripting XSS by supplying crafted function source text that bypasses escaping logic. When the resulting serialized data is rendered inside an HTML script block on a web page, the unneutralized...
CLSA-2026-1793293533 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 2.1.2-tuxcare.3...
CLSA-2026-1793293234 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 4.0.0-tuxcare.2...
CLSA-2026-1793293147 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 3.1.0-tuxcare.3...
CLSA-2026-1793292719 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 5.0.1-tuxcare.4...
CLSA-2026-1793291203 TuxCare security update for serialize-javascript (1 CVE)
TuxCare rebuilt serialize-javascript to address 1 CVE. Fixed in 1.9.1-tuxcare.3...
EUVD-2026-110462
Seroval: Code injection through a typed array's own constructor property...
Seroval: Code injection through a typed array's own constructor property
Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitra...
GHSA-F86P-H4J2-7QGJ Seroval: Code injection through a typed array's own constructor property
Summary seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitra...
GHSA-9WX9-5PV9-3349 Seroval: Script injection through RegExp sources in serialized output
Summary seroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. -...
Seroval: Script injection through RegExp sources in serialized output
Summary seroval writes a RegExp as a regular expression literal. In affected versions, the element that the serialized output is placed in, and run script in the page. Details seroval escapes element. RegExp sources did not get the same escaping: - Versions before 1.0.0 wrote the source as is. -...