MAL-2022-7103 Malicious code in webpack-vue-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27e35f389298125c20db05c37d588a87a0285d3dbcf16e16c8250b0519ac3ec6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@alauda/custom-webpack (>=4.0.0, <=4.4.0), @glow-app/glow-client (0.3.0) +43 more potentially affected by CVE-2022-33987 via got (>=12.0.0, <=12.0.4)

got NPM version =12.0.0, =4.0.0, =1.0.1, =6.1.1, =11.1.2, =9.2.2, =4.1.2, =4.0.2, =1.0.0, =1.7.0, =0.0.0, =2.1.0, =1.1.0, =1.10.0, =2.5.0, =2.5.1 and more Source cves: CVE-2022-33987 Source advisory: GHSA-PFRX-2Q88-QQ97...

CVE-2022-25863

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

Deserialization of untrusted data

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

CVE-2022-25863

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

CVE-2022-25863: Deserialization of Untrusted Data

The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible whe...

PT-2022-17574

Name of the Vulnerable Software and Affected Versions gatsby-plugin-mdx versions 3.0.0 through 3.15.1 gatsby-plugin-mdx versions 2.14.0 and earlier Description The gatsby-plugin-mdx plugin is vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, du...

Arbitrary code execution in post-loader

post-loader is webpack loader for blog posts written in Markdown. The package post-loader from 0.0.0 is vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed. At this time, there...

GHSA-66WW-999Q-MFFQ Arbitrary code execution in post-loader

post-loader is webpack loader for blog posts written in Markdown. The package post-loader from 0.0.0 is vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed. At this time, there...

Post-loader cross-site scripting vulnerabilities

post-loader is a Webpack loader for China EGOIST individual developers. It is used to write blog posts in Markdown. A cross-site scripting vulnerability exists in post-loader, which stems from the use of the markdown parser in an insecure manner, so that any javascript code in a markdown input fi...

Security update for nodejs-electron (important)

openSUSE Security Update: Security update for nodejs-electron Announcement ID: openSUSE-SU-2022:0070-1 Rating: important References: Cross-References: CVE-2021-30625 CVE-2021-30626 CVE-2021-30627 CVE-2021-30628 CVE-2021-30630 CVE-2021-30631 CVE-2021-30632 CVE-2021-30633 CVE-2021-37981...

ZEIT Next.js Input Validation Vulnerability

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. ZEIT Next.js suffers from an input validation error vulnerability that stems from the software's lack of effective handling of incorrectly formatted urls. An invalid or incorrectly...

Older releases of better_errors open to Cross-Site Request Forgery attack

Impact bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with...

GHSA-W3J4-76QW-WWJM Older releases of better_errors open to Cross-Site Request Forgery attack

Impact bettererrors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with...

ZEIT Next.js Input Validation Error Vulnerability (CNVD-2021-61800)

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack, and Babel.js. ZEIT Next.js is vulnerable to an input validation error in versions prior to 11.1.0, which stems from a web system or product that does not properly validate input data. An attacker...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +15380 more potentially affected by CVE-2021-24033 via react-dev-utils (>=0.4.0, <=11.0.3)

react-dev-utils NPM version =0.4.0, =1.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2, =1.0.3, =1.0.11 and more Source cves: CVE-2021-24033 Source advisory: OSV:GHSA-5Q6M-3H65-W53X...

CVE-2020-29041

A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension code review. Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contai...

Code injection

A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension code review. Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contai...

CVE-2020-29041

The CVE-2020-29041 entry describes a misconfiguration in Web-Sesame 2020.1.1.3375 where JavaScript source maps were included in production Webpack config, allowing an unauthenticated attacker to download the application’s source code and related artifacts (bundle sources, configuration settings s...

PT-2021-11640

Name of the Vulnerable Software and Affected Versions: Web-Sesame version 2020.1.1.3375 Description: A misconfiguration in the software allows an unauthenticated attacker to download the source code of the application. This is due to JavaScript source maps being inadvertently included in the...