CVE-2023-26487 Vega has cross-site scripting vulnerability in `lassoAppend` function

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs.lassoAppend' function accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as push call argument...

GHSA-W5M3-XH75-MP55 Vega has Cross-site Scripting vulnerability in `lassoAppend` function

Summary Vega's lassoAppend function: lassoAppend accepts 3 arguments and internally invokes push function on the 1st argument specifying array consisting of 2nd and 3rd arguments as push call argument. The type of the 1st argument is supposed to be an array, but it's not enforced. This makes it...

Denial Of Service (DoS)

podium is vulnerable to Denial of Service DoS. This is because the function setImmediate can be called multiple times, and the callbacks are queued for execution and processed in every event loop iteration. An attacker can manipulate calls to the server to consume a high amount of CPU, leading to...