Packer-Fuzzer - A Fast And Efficient Scanner For Security Detection Of Websites Constructed By Javascript Module Bundler Such As Webpack

With the popularity of web front-end packaging tools, have you encountered more and more websites represented by Webpack packager in daily penetration testing and security services? This type of packager will package the API and API parameters of the entire site together for centralized Web call,...

grafana security, bug fix, and enhancement update

6.7.4-3 - apply patch for CVE-2020-13430 also to sources, not only to compiled webpack 6.7.4-2 - security fix for CVE-2020-13430 6.7.4-1 - update to 6.7.4 tagged upstream community sources, see CHANGELOG - security fix for CVE-2020-13379 6.7.3-1 - update to 6.7.3 tagged upstream community sources...

webpack-subresource-integrity data forgery issue vulnerability

webpack-subresource-integrity is a personal developer's npm extension for website static file security. The library generates an encrypted hash code that can be used to verify that files fetched by the browser e.g. from a CDN are secure. A webpack plugin vulnerability exists in versions prior to...

Subresource Integrity Bypass

webpack-subresource-integrity is vulnerable to subresource integrity bypass. Dynamically injected tags use undefined and the integrity check can be bypassed, potentially resulting in cross-site scripting attacks...

Lack Of Integrity Hash Validation

webpack-subresource-integrity suffers from a lack of integrity hash verification. An additional layer of SRI protection for all dynamically loaded chunks receives an invalid integrity hash and is ignored by the browser...

CVE-2020-15262

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-lev...

CVE-2020-15262

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-lev...

Input validation

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-lev...

CVE-2020-15262

Summary : CVE-2020-15262 affects webpack-subresource-integrity prior to 1.5.1. All dynamically loaded chunks receive an invalid integrity hash, which the browser ignores, removing the extra protection from SRI. Top-level chunks are unaffected. Impact (as stated) : The browser cannot validate inte...

CVE-2020-15262 Invalid integrity hashes in webpack-subresource-integrity

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-lev...

Unprotected dynamically loaded chunks

Impact All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. Patches This issue is...

@aldendaniels/react-scripts (=0.8.3), @amc-technology/ui-library (=1.0.10) +186 more potentially affected by CVE-2020-15262 via webpack-subresource-integrity (>=0.7.0 <=1.5.0)

webpack-subresource-integrity NPM version =0.7.0, =1.2.3, =9.0.0, =0.8.8, =0.0.1-SNAPSHOT, =0.0.1-alpha.1, =1.2.2, =0.1.8, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =10.0.0 and more Source cves: CVE-2020-15262 Source advisory: OSV:GHSA-4FC4-CHG7-H8GH...

@amazingcat/amazing-iohook (>=7.1.4 <=8.1.1), @barajs/electron (>=1.0.0 <=1.0.2) +30 more potentially affected by CVE-2020-15096 via electron (>=7.0.0 <=7.2.3)

electron NPM version =7.0.0, =7.1.4, =1.0.0, =0.0.3, =0.3.0, =4.0.0-alpha.3, =7.0.0, =4.0.0-alpha.1, =0.0.1, =7.0.0, =1.7.0, =7.0.0, =8.0.0, =0.31.0-alpha.2, =0.31.0-alpha.33 and more Source cves: CVE-2020-15096 Source advisory: OSV:GHSA-6VRV-94JV-CRRG...

Command Injection

Amendment This was deemed not a vulnerability. Overview git-revision-webpack-plugin is a simple webpack plugin that generates version and commithash files during build based on a local git repository. Affected versions of this package are vulnerable to Command Injection. The function commithash...

Denial Of Service (DoS)

webpack-dev-middleware is vulnerable to denial of service. A memory leak occurs when the function writeToDisk is used, causing the compile-time to keep increasing as the duplicates write to disk keep increasing, eventually leading to a denial of service condition...

3d-box (>=0.0.3 <=0.0.7), @500tech/react-scripts (>=1.1.3 <=5.1.0-beta.4) +1066 more potentially affected by unknown CVE via webpack-bundle-analyzer (>=1.4.1 <=3.2.0)

webpack-bundle-analyzer NPM version =1.4.1, =0.0.3, =1.1.3, =1.0.0, =1.0.0, =0.9.0, =0.0.1-canary.49, =1.0.0, =0.0.1, =1.0.1-0, =2.1.0, =2.1.2-4, =1.0.1-0, =0.0.7, =0.0.28 and more Source cves: unknown CVE Source advisory: OSV:GHSA-PGR8-JG6H-8GW6...

GHSA-PGR8-JG6H-8GW6 Cross-Site Scripting in webpack-bundle-analyzer

Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify without properly escaping input which may lead to Cross-Site Scripting. Recommendation Upgrade to version 3.3.2 or later...

Cross-Site Scripting in webpack-bundle-analyzer

Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify without properly escaping input which may lead to Cross-Site Scripting. Recommendation Upgrade to version 3.3.2 or later...

Cross-Site Scripting

Overview Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify without properly escaping input which may lead to Cross-Site Scripting. Recommendation Upgrade to version 3.3.2 or later. References - GitHub PR - Snyk Report - GitH...

-tompan-reacttemplate (>=1.0.1 <=1.1.0), 0726react (=0.1.1) +23456 more potentially affected by CVE-2018-14732 via webpack-dev-server (>=1.10.1 <=3.1.10)

webpack-dev-server NPM version =1.10.1, =1.0.1, =1.1.0 - 0726react =0.1.1 - 0x0.icu.anima =0.1.0 - 0xgank-tea-advice-pull =1.0.0 - 0xgank-tea-balance-pencil =1.0.0 - 0xgank-tea-brick-bell =1.0.0 - 0xgank-tea-cake-victory =1.0.0 - 0xgank-tea-central-compound =1.0.0 - 0xgank-tea-characteristic =1.0...