Archive
4 June 2019
Vulnerabilities first published on this day (UTC), newest first.
7 results · Clear filters · Feed
-
High —
Code Injection in js-yaml
Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping key…
-
High —
NoSQL Injection in sequelize
Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection. ## Recommendation Upgrade to version 4.12.0 or lat…
-
High 7.5
Denial of Service in ws
Affected versions of `ws` can crash when a specially crafted `Sec-WebSocket-Extensions` header containing `Object.prototype` property names as extension or parameter names is sent. ## Proof of concept ``` const WebSocket = require('ws'); const net = require('…
-
High —
NoSQL Injection in loopback-connector-mongodb
Versions of `loopback-connector-mongodb` before 3.6.0 are vulnerable to NoSQL injection. MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Dr…
-
High —
Cross-Site Scripting (XSS) in cloudcmd
Versions of `cloudcmd` before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a file for this vulnerability to be exploitable. ## Recommendation Update to version 9.1.6 or later.
-
High 7.5
Sensitive Data Exposure in pem
Versions of `pem` before 1.13.2 expose sensitive data when the `readPkcs12` is used. The `readPkcs12` function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file wit…
-
High 8.1
Incorrect Resource Transfer Between Spheres in Grails
Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.