Archive
2 September 2020
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
Medium 5.9
Denial of Service in ipfs-bitswap
Versions of `ipfs-bitswap` prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions. ## Recommendation Upgrade to version 0.24.1 or lat…
-
Medium —
Sandbox Breakout / Arbitrary Code Execution in value-censorship
All versions of `value-censorship` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. ## Recommendation No fix is currently available. Cons…
-
Medium —
Cross-Site Scripting in google-closure-library
Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through M…
-
Medium 6.8
Dell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attack…
-
Medium 6.8
Dell Inspiron 7347 BIOS versions prior to A13 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attack…
-
Medium 6.8
Dell G7 17 7790 BIOS versions prior to 1.13.2 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attack…
-
Medium —
HTML Injection in preact
Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-S…
-
Medium 5.4
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium 5.4
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium 5.4
IBM Jazz Team Server based Applications are vulnerable to cross-site scripting. This vulnerability allows users to embe…
-
Medium —
Unauthorized File Access in glance
Versions of `glance` prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a `--nodot` option meant to hide files and directories with names that begin with a `.`, such as `.git` but fails to hide files inside a folder that begins wi…
-
Medium —
Cross-Site Scripting in buttle
All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, `buttle` does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. ## Recommenda…
-
Medium 4.3
Incorrect Authorization in TYPO3 extension
The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosure (translatable fields).
-
Medium 4.3
Information Disclosure in TYPO3 extension sf_event_mgt
The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure (participant data, and event data via email) because of Broken Access Control.
-
Medium —
Prototype Pollution in smart-extend
All versions of `smart-extend` are vulnerable to Prototype Pollution. The `deep()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects. ## Recommendation No fi…
-
Medium —
Sandbox Breakout / Arbitrary Code Execution in sandbox
All versions of `sandbox` through 0.8.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors. ## Proof of concept ``` var Sandbox = require("sandbox")…