Skip to content
OpenAdvisories

Archive

13 June 2019

Vulnerabilities first published on this day (UTC), newest first.

← May 2019 2019 / June /13 July 2019 →
  1. 11
  2. 24
  3. 396
  4. 436
  5. 5167
  6. 657
  7. 779
  8. 8 
  9. 9 
  10. 1023
  11. 1145
  12. 12126
  13. 1345
  14. 1449
  15. 158
  16. 161
  17. 1770
  18. 1850
  19. 1995
  20. 2056
  21. 2125
  22. 22 
  23. 233
  24. 2430
  25. 2526
  26. 2635
  27. 27108
  28. 2829
  29. 2915
  30. 3024
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.3
    GHSA-74cr-77xc-8g6r

    Prototype Pollution in @apollo/gateway

    Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can…

    @apollo/gateway npm
  • High —
    GHSA-49r3-3h96-rwj6

    Cross-Site Scripting in ids-enterprise

    Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version 4.18.2 o…

    ids-enterprise npm
  • High —
    GHSA-hpfq-8wx8-cgqw

    Cross-Site Scripting in ids-enterprise

    Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version …

    ids-enterprise npm
  • High —
    GHSA-crfx-5phg-hmw9

    Cross-Site Scripting in ids-enterprise

    Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version …

    ids-enterprise npm
  • High —
    GHSA-h6ch-v84p-w6p9

    Regular Expression Denial of Service (ReDoS)

    A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

    diff npm
  • High 7.3
    GHSA-f7qw-5pvg-mmwp

    Prototype Pollution in lutils-merge

    All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial …

    lutils-merge npm