Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Critical 9.1
Malicious Package in wbe3
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in web3-eht
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in smartsearchwp
All versions of `smartsearchwp` contain malicious code. The package is malware intended to steal credentials from websites it is loaded in. It traverses DOM elements looking for fields such as `username` and `password` and uploads it to a remote server. The p…
-
Medium 6.1CVE-2020-23814 Scanner template
xxl-job Multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.
-
High 7.5
xxl-job sensitive data exposure
xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.
-
High —
Path Traversal in file-static-server
All versions of `file-static-server` are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. ## Recommendation No fix is currently available. Consider usi…
-
Low —
Sensitive Data Exposure in put
All versions of `put` are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This v…
-
High —
Path Traversal in ponse
Versions of `ponse` prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. ## Recommendation Upgrade to version 2.0.2 or later.
-
High —
Path Traversal in bruteser
Versions of `bruteser` prior to 0.1.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. ## Recommendation Upgrade to version 0.1.0 or later.
-
Medium 6.1
silverstripe-advancedreports vulnerable to XSS
silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectRepo…
-
Unscored —
The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability. Attac…
-
Unscored —
Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. Attackers can use this vulnerab…
-
Unscored —
Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers …
-
Unscored —
NetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers to gain server permiss…
-
Unscored —
360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicio…
-
Unscored —
Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which …
-
High —
Improper Authorization in @sap-cloud-sdk/core
Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs. The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provid…
-
High —
Cross-Site Scripting in @toast-ui/editor
Versions of `@toast-ui/editor` prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS). There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser. ## Recommendati…
-
Critical —
Malicious Package in m-backdoor
All versions of `m-backdoor` contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly …
-
Medium —
Buffer Overflow in node-weakauras-parser
Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems. ## Recommendation Upgrade …
-
Critical —
Path Traversal in sapper
Versions of `sapper` prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded `../`. You may test a `sapper` application running in prod mode with `curl -vvv http://…
-
High —
Cross-Site Scripting in htmr
Versions of `htmr` prior to 0.8.7 are vulnerable to Cross-Site Scripting (XSS). The package uses `innerHTML` to unescape HTML entities. This may lead to [DOM-based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS) through HTML-encoded XSS payloads. …
-
High —
Cross-Site Scripting in lazysizes
Versions of `lazysizes` prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The `video-embed` plugin fails to sanitize the following attributes: data-vimeo, `data-vimeoparams`, `data-youtube` and `data-ytparams`. This allows attackers to execute arbitr…
-
Critical —
Command Injection in priest-runner
All versions of `priest-runner` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a `spawn` call, which may allow attackers to execute arbitrary code in the system. The `PriestController.prototype.createChild `…
-
Critical —
Improper Authorization in react-oauth-flow
All versions of `react-oauth-flow` fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise se…
-
High —
Cross-Site Scripting in ngx-md
Versions of `ngx-md` prior to 6.0.3 are vulnerable to Cross-Site Scripting. Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as `[Click Me](javascript:alert('Injected!'%…
-
High —
Prototype Pollution in @commercial/subtext
Versions of `@commercial/subtext` prior to 5.1.2 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may…
-
High —
Denial of Service in @commercial/hapi
Affected versions of `@commercial/hapi` are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is av…
-
High —
Denial of Service in @hapi/hapi
Versions of `@hapi/hapi` prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception ha…
-
High —
Denial of Service in hapi
All Versions of `hapi` are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the appl…
-
High —
Prototype Pollution in @hapi/subtext
Versions of `@hapi/pez` prior to 4.1.2 or 5.0.1 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may …
-
High —
Prototype Pollution in pez
All versions of `pez` are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation ru…
-
High —
Denial of Service in content
Versions of `content` are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as op…
-
High —
Denial of Service in @commercial/subtext
Version 5.1.1 of `@commercial/subtext` is vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows syst…
-
High —
Denial of Service in @hapi/content
Versions of `@hapi/content` prior to 4.1.1 and 5.0.1 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hap…
-
High —
Denial of Service in @hapi/ammo
Versions of `@hapi/ammo` prior to 3.1.2 or 5.0.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expectin…
-
High —
Denial of Service in @hapi/accept
Versions of `@hapi/accept` prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi r…
-
High —
Denial of Service in ammo
All versions of `ammo` are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever thr…
-
Medium —
HTML Injection in marky-markdown
All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, suc…
-
High 7.3
HTML Injection in marky-markdown
All versions of `marky-markdown` are vulnerable to HTML Injection. The package fails to sanitize `style` attributes in `img` tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. ## Recommendation This package…