Code Execution through IIFE in node-serialize

Affected versions of node-serialize can be abused to execute arbitrary code via an immediately invoked function expression IIFE if untrusted user input is passed into unserialize. Recommendation There is no direct patch for this issue. The package author has reviewed this advisory, and provided t...

@contrast/loopback-test-bench (3.15.0), @contrast/test-bench-utils (>=2.7.0, <=3.39.0) +34 more potentially affected by CVE-2017-5941 via node-serialize (>=0.0.3, <=0.0.4)

node-serialize NPM version =0.0.3, =2.7.0, =1.1.0, =1.0.1, =1.0.0, =1.1.1, =1.0.0, =1.0.4, =1.0.0, =1.0.0, =0.0.1, =1.0.4 and more Source cves: CVE-2017-5941 Source advisory: GHSA-Q4V7-4RHW-9HQM...

Code Execution Through IIFE in serialize-to-js

Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression IIFE. Proof of Concept js var payload = "e: function eval'console.logexploited' " var serialize = require'serialize-to-js'; serialize.deserializepayload;...

GHSA-MM62-WXC8-CF7M Code Execution Through IIFE in serialize-to-js

Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression IIFE. Proof of Concept js var payload = "e: function eval'console.logexploited' " var serialize = require'serialize-to-js'; serialize.deserializepayload;...

PT-2018-3787

Name of the Vulnerable Software and Affected Versions PHP versions 5.x through 7.1.24 Description The issue is related to errors in pointer dereferencing in the PHP interpreter, specifically in the ext/standard/var.c component. This can be exploited by a remote attacker to cause a denial of...

PJSIP PJSUA2 SDK for Android Arbitrary Code Execution Vulnerability

PJSIP PJSUA2 SDK for Android is an Android-based software development kit that provides APIs for building Session Initiation Protocol SIP multimedia user agent applications. A security vulnerability exists in versions of the PJSIP PJSUA2 SDK for Android prior to SVN Changeset 51322. The...

CVE-2017-15871

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agrees that...

Design/Logic Flaw

DISPUTED The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agree...

CVE-2017-15871

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agrees that...

CVE-2017-15871

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agrees that...

CVE-2017-15871

The CVE-2017-15871 entry affects the deserialize function in serialize-to-js (versions ≤ 1.1.1). Affected input involving an Immediately Invoked Function Expression substring (e.g., function(){console.log(…)}) can cause a denial of service. The vendor acknowledges the DoS risk and states deserial...

PT-2017-14251 · Unknown · Serialize-To-Js

Name of the Vulnerable Software and Affected Versions: serialize-to-js versions 1.1.1 and earlier Description: The issue allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring. This can be demonstrated by a...

CVE-2017-15871: Loop with Unreachable Exit Condition

The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function" substring, as demonstrated by a "functionconsole.log" call or a simple infinite loop. NOTE: the vendor agrees that...

For the Node. js in the node-serialize module deserialization vulnerability the subsequent analysis-vulnerability warning-the black bar safety net

Of the Node. js serialization remote command execution vulnerabilities of a number of follow-up found and how to develop the attack load. A few days ago I was in opsecx blog found an article How to use a named node-serialize nodejs module in the RCE remote code execution error blog. The article...

Node-serialize Package For Node.js 'unserialize()' Function Arbitrary Code Execution Vulnerability

Node.js is an open source, cross-platform, runtime environment for server-side and web applications. Node.js has a security vulnerability in the node-serialize module that allows an attacker to execute arbitrary code via IIFE if the unserialize function input is not secure...

Node.js suffers from a deserialization remote code execution vulnerability

Node.js is a Javascript runtime. It is actually a wrapper around the Google V8 engine. In fact, it is the Google V8 engine package . Node.js is a platform based on the Chrome JavaScript runtime built for easy to build responsive , easy to extend the web application . A deserialization remote code...

Code Execution Through IIFE

Overview Affected versions of serialize-to-js may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression IIFE. Proof of Concept var payload = "e: function eval'console.logexploited' " var serialize = require'serialize-to-js'; serialize.deserializepayload;...

Code injection

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

CVE-2017-5954

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...

CVE-2017-5954

An issue was discovered in the serialize-to-js package 0.5.0 for Node.js. Untrusted data passed into the deserialize function can be exploited to achieve arbitrary code execution by passing a JavaScript Object with an Immediately Invoked Function Expression IIFE...