Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,802 results · page 25 of 57
Jun 26, 2024@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications.CVE-2024-38375 · Other software · fastly · reported by GitHubMedium 5.3
@fastly/js-compute is a JavaScript SDK and runtime for building Fastly Compute applications. The implementation of several functions were determined to include a use-after-free bug. This bug could allow for unintended data loss if the result of the preceding functions were sent anywhere else, and often results in a guest trap causing services to return a 500. This bug has been fixed in version 3.16.0 of the `@fastly/js-compute` package.
- Product
- js-compute-runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2024XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information abouCVE-2024-27136 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
- Product
- Apache JSPWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjspwiki-wiki.apache.orglists.apache.org
Jun 14, 2024In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.CVE-2024-36656 · Other software · minthcm · reported by MITREMedium 6.1
In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.
- Product
- minthcm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024Toshiba printers provide a web interface that will load the JavaScript file.CVE-2024-27162 · Other software · Toshiba Tec Corporation · reported by ecc0f906-8666-484c-bcf8-c3b7520a72f0Medium 6.1
Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the reference URL.
- Product
- Toshiba Tec e-Studio multi-function peripheral (MFP)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2024An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap.CVE-2024-5694 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
An attacker could have caused a use-after-free in the JavaScript engine to read memory in the JavaScript string section of the heap. This vulnerability affects Firefox < 127.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Jun 10, 2024@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.CVE-2024-37168 · Other software · grpc · reported by GitHubMedium 5.3
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_message_length` channel option: If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded; and/or if an incoming message has a size within the limit on the wire but decompresses to a size greater than the limit, the entire message is decompressed into memory, and on the server is not discarded. This has been patched in versions 1.10.9, 1.9.15, and 1.8.22.
- Product
- grpc-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 5, 2024A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user.CVE-2024-4812 · Other software · Red Hat · reported by Red HatMedium 4.8
A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections.
- Product
- Red Hat Satellite 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Jun 3, 2024A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView.CVE-2023-51219 · Other software · reported by MITRECritical 9.6
A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controlled JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access token could be used to take over another user's account and read her/his chat messages.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnews.ycombinator.comstulle123.github.io
May 31, 2024javascript-deobfuscator removes common JavaScript obfuscation techniques.CVE-2024-36120 · Other software · ben-sb · reported by GitHubHigh 8.1
javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the expression simplification feature.
- Product
- javascript-deobfuscator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2024Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or comCVE-2024-36361 · Other software · pugjs · reported by MITREMedium 6.8
Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.
- Product
- pug
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface whenCVE-2024-34241 · Other software · rocketsoft · reported by MITREMedium 4.8
A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications.
- Product
- rocket_lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2024The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScriptCVE-2024-31974 · Other software · solarized · reported by MITREMedium 6.3
The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. com.solarized.firedown.IntentActivity uses a WebView component to display web content and doesn't adequately sanitize the URI or any extra data passed in the intent by any installed application (with no permissions).
- Product
- firedown_browser_and_downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses.CVE-2024-4769 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.9
When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
May 14, 2024A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.CVE-2024-4367 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.8
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orglists.debian.org
May 14, 2024Microsoft Power BI Client JavaScript SDK Information Disclosure VulnerabilityCVE-2024-30054 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability
- Product
- PowerBI-client JS SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
May 14, 2024The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript.CVE-2024-34345 · Other software · CycloneDX · reported by GitHubHigh 8.1
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
- Product
- cyclonedx-javascript-library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted inpCVE-2024-32672 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.3
A Segmentation Fault issue discovered in Samsung Open Source Escargot JavaScript engine allows remote attackers to cause a denial of service via crafted input. This issue affects Escargot: 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024 Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers.CVE-2024-32669 · Computers, phones & browsers · Samsung Open Source · reported by PSIRT@samsung.comMedium 5.3
Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and does not include in the release. This issue affects escargot: 4.0.0.
- Product
- Escargot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2024 A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript inCVE-2024-33604 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exist in undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2024 A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript iCVE-2024-31156 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8
A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-34346 · Other software · denoland · reported by GitHubHigh 8.4
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading `/proc/self/environ` may provide access equivalent to `--allow-env`, and writing `/proc/self/mem` may provide access equivalent to `--allow-all`. Users who grant read and write access to the entire filesystem may not realize that these access to these files may have additional, unintended consequences. The documentation did not reflect that this practice should be undertaken to increase the strength of the security sandbox. Users who run code with `--allow-read` or `--allow-write` may unexpectedly end up granting additional permissions via file-system operations. Deno 1.43 and above require explicit `--allow-all` access to read or write `/etc`, `/dev` on unix platform (as well as `/proc` and `/sys` on linux platforms), and any path starting with `\\` on Windows.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024PDF-XChange Editor JavaScript String Untrusted Pointer Dereference Remote Code Execution Vulnerability.CVE-2023-40472 · Other software · PDF-XChange · reported by zdi-disclosures@trendmicro.comHigh 7.8
PDF-XChange Editor JavaScript String Untrusted Pointer Dereference Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of strings. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20730.
- Product
- PDF-XChange Editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordzerodayinitiative.comzerodayinitiative.com
Apr 29, 2024An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.CVE-2024-32492 · Other software · znuny · reported by MITREHigh 7.1
An issue was discovered in Znuny 7.0.1 through 7.0.16 where the ticket detail view in the customer front allows the execution of external JavaScript.
- Product
- znuny
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2024Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code intoCVE-2024-4302 · Other software · Super 8 · reported by twcert@cert.org.twMedium 6.1
Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. When the message recipient views the message, they become susceptible to Cross-site Scripting (XSS) attacks.
- Product
- livechat SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Apr 28, 2024The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.CVE-2024-33883 · Other software · reported by MITREMedium 4
The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2024A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer ServiCVE-2023-6717 · Other software · Red Hat · reported by Red HatMedium 6
A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.
- Product
- Red Hat AMQ Broker 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Apr 23, 2024Hono is a Web application framework that provides support for any JavaScript runtime.CVE-2024-32869 · Other software · honojs · reported by GitHubMedium 5.3
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.2.7, when using serveStatic with deno, it is possible to traverse the directory where `main.ts` is located. This can result in retrieval of unexpected files. Version 4.2.7 contains a patch for the issue.
- Product
- hono
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-32477 · Other software · denoland · reported by GitHubHigh 7.7
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. By using ANSI escape sequences and a race between `libc::tcflush(0, libc::TCIFLUSH)` and reading standard input, it's possible to manipulate the permission prompt and force it to allow an unsafe action regardless of the user input. Some ANSI escape sequences act as a info request to the master terminal emulator and the terminal emulator sends back the reply in the PTY channel. standard streams also use this channel to send and get data. For example the `\033[6n` sequence requests the current cursor position. These sequences allow us to append data to the standard input of Deno. This vulnerability allows an attacker to bypass Deno permission policy. This vulnerability is fixed in 1.42.2.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2024@solana/web3.js is the Solana JavaScript SDK.CVE-2024-30253 · Other software · solana-labs · reported by GitHubHigh 7.5
@solana/web3.js is the Solana JavaScript SDK. Using particular inputs with `@solana/web3.js` will result in memory exhaustion (OOM). If you have a server, client, mobile, or desktop product that accepts untrusted input for use with `@solana/web3.js`, your application/service may crash, resulting in a loss of availability. This vulnerability is fixed in 1.0.1, 1.10.2, 1.11.1, 1.12.1, 1.1.2, 1.13.1, 1.14.1, 1.15.1, 1.16.2, 1.17.1, 1.18.1, 1.19.1, 1.20.3, 1.21.1, 1.22.1, 1.23.1, 1.24.3, 1.25.1, 1.26.1, 1.27.1, 1.28.1, 1.2.8, 1.29.4, 1.30.3, 1.31.1, 1.3.1, 1.32.3, 1.33.1, 1.34.1, 1.35.2, 1.36.1, 1.37.3, 1.38.1, 1.39.2, 1.40.2, 1.41.11, 1.4.1, 1.42.1, 1.43.7, 1.44.4, 1.45.1, 1.46.1, 1.47.5, 1.48.1, 1.49.1, 1.50.2, 1.51.1, 1.5.1, 1.52.1, 1.53.1, 1.54.2, 1.55.1, 1.56.3, 1.57.1, 1.58.1, 1.59.2, 1.60.1, 1.61.2, 1.6.1, 1.62.2, 1.63.2, 1.64.1, 1.65.1, 1.66.6, 1.67.3, 1.68.2, 1.69.1, 1.70.4, 1.71.1, 1.72.1, 1.7.2, 1.73.5, 1.74.1, 1.75.1, 1.76.1, 1.77.4, 1.78.8, 1.79.1, 1.80.1, 1.81.1, 1.8.1, 1.82.1, 1.83.1, 1.84.1, 1.85.1, 1.86.1, 1.87.7, 1.88.1, 1.89.2, 1.90.2, 1.9.2, and 1.91.3.
- Product
- solana-web3.js
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2024The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment.CVE-2024-3862 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 5.3
The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. This vulnerability affects Firefox < 125.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 16, 2024It was possible to mutate a JavaScript object so that the JIT could crash while tracing it.CVE-2024-3858 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
It was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects Firefox < 125.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 16, 2024A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started.CVE-2024-3853 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 7.5
A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection started. This vulnerability affects Firefox < 125.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Apr 10, 2024`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities.CVE-2024-31995 · Other software · digitalbazaar · reported by GitHubMedium 4.3
`@digitalbazaar/zcap` provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the `expires` property is not properly checked against the current date or other `date` param. This can allow invocations outside of the original intended time period. A zcap still cannot be invoked without being able to use the associated private key material. `@digitalbazaar/zcap` v9.0.1 fixes expiration checking. As a workaround, one may revoke a zcap at any time.
- Product
- zcap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2024360 Javascript Viewer: Unauthorized modification of dataCVE-2024-1637 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and nonce exposure on several AJAX actions in all versions up to, and including, 1.7.12. This makes it possible for authenticated attackers, with subscriber access or higher, to update plugin settings.
- Product
- 360 Javascript Viewer
- Affected
- up to 1.7.12
- What to do
- Affects up to 1.7.12. Update 360 Javascript Viewer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024A stored cross-site scripting (XSS) vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaScript code by includiCVE-2024-31544 · Other software · Oretnom23 · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary JavaScript code by including malicious payloads into “remarks”, “borrower_name”, “faculty_department” parameters in /classes/Master.php?f=save_record.
- Product
- Computer Laboratory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2024Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerability affects Firefox foCVE-2024-31393 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 4.3
Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerability affects Firefox for iOS < 124.
- Product
- Firefox for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Mar 28, 2024The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code viaCVE-2024-23727 · Other software · kamivision · reported by MITREHigh 8.4
The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.
- Product
- yi_iot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024KaTeX is a JavaScript library for TeX math rendering on the web.CVE-2024-28246 · Other software · KaTeX · reported by GitHubMedium 5.5
KaTeX is a JavaScript library for TeX math rendering on the web. Code that uses KaTeX's `trust` option, specifically that provides a function to blacklist certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate `javascript:` links in the output, even if the `trust` function tries to forbid this protocol via `trust: (context) => context.protocol !== 'javascript'`. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
- Product
- KaTeX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024KaTeX is a JavaScript library for TeX math rendering on the web.CVE-2024-28245 · Other software · KaTeX · reported by GitHubMedium 6.3
KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\includegraphics` that runs arbitrary JavaScript, or generate invalid HTML. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
- Product
- KaTeX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024KaTeX is a JavaScript library for TeX math rendering on the web.CVE-2024-28244 · Other software · KaTeX · reported by GitHubMedium 6.5
KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\def` or `\newcommand` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. KaTeX supports an option named maxExpand which aims to prevent infinitely recursive macros from consuming all available memory and/or triggering a stack overflow error. Unfortunately, support for "Unicode (sub|super)script characters" allows an attacker to bypass this limit. Each sub/superscript group instantiated a separate Parser with its own limit on macro executions, without inheriting the current count of macro executions from its parent. This has been corrected in KaTeX v0.16.10.
- Product
- KaTeX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2024KaTeX is a JavaScript library for TeX math rendering on the web.CVE-2024-28243 · Other software · KaTeX · reported by GitHubMedium 6.5
KaTeX is a JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions could encounter malicious input using `\edef` that causes a near-infinite loop, despite setting `maxExpand` to avoid such loops. This can be used as an availability attack, where e.g. a client rendering another user's KaTeX input will be unable to use the site due to memory overflow, tying up the main thread, or stack overflow. Upgrade to KaTeX v0.16.10 to remove this vulnerability.
- Product
- KaTeX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the CVE-2024-2726 · Other software · Ciges · reported by cve-coordination@incibe.esMedium 6.1
Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.
- Product
- CIGESv2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2024An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process.CVE-2024-29944 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgHigh 8.4
An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, it does not affect mobile versions of Firefox. This vulnerability affects Firefox < 124.0.1 and Firefox ESR < 115.9.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.mozilla.org
Mar 22, 2024An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination.CVE-2024-29943 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affects Firefox < 124.0.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.mozilla.org
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults.CVE-2024-27936 · Other software · denoland · reported by GitHubHigh 8.8
Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request contents. Deno is stripping any ANSI escape sequences from the permission prompt, but permissions given to the program are based on the contents that contain the ANSI escape sequences. Any Deno program can spoof the content of the interactive permission prompt by inserting a broken ANSI code, which allows a malicious Deno program to display the wrong file path or program name to the user. Version 1.41.0 of the deno library contains a patch for the issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27935 · Other software · denoland · reported by GitHubHigh 7.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer (BUF) in stream_wrap.ts used as a performance optimization to limit allocations during these asynchronous read operations. This can lead to data intended for one session being received by another session, potentially resulting in data corruption and unexpected behavior. This affects all users of Deno that use the node.js compatibility layer for network communication or other streams, including packages that may require node.js libraries indirectly. Version 1.36.3 contains a patch for this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27934 · Other software · denoland · reported by GitHubHigh 8.4
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.36.2 and prior to version 1.40.3, use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, resulting in arbitrary code execution. Use of inherently unsafe `*const c_void` and `ExternalPointer` leads to use-after-free access of the underlying structure, which is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable for both `*const c_void` and `ExternalPointer` implementations. Version 1.40.3 fixes this issue.
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27933 · Other software · denoland · reported by GitHubHigh 8.2
Deno is a JavaScript, TypeScript, and WebAssembly runtime. In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Node child_process IPC relies on the JS side to pass the raw IPC file descriptor to `op_node_ipc_pipe()`, which returns a `IpcJsonStreamResource` ID associated with the file descriptor. On closing the resource, the raw file descriptor is closed together. Use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors. This allow standard input (fd 0) to be closed and re-opened for a different resource, which allows a silent permission prompt bypass. This is exploitable by an attacker controlling the code executed inside a Deno runtime to obtain arbitrary code execution on the host machine regardless of permissions. This bug is known to be exploitable. There is a working exploit that achieves arbitrary code execution by bypassing prompts from zero permissions, additionally abusing the fact that Cache API lacks filesystem permission checks. The attack can
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2024Deno is a JavaScript, TypeScript, and WebAssembly runtime.CVE-2024-27932 · Other software · denoland · reported by GitHubMedium 4.6
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.8.0 and prior to version 1.40.4, Deno improperly checks that an import specifier's hostname is equal to or a child of a token's hostname, which can cause tokens to be sent to servers they shouldn't be sent to. An auth token intended for `example[.]com` may be sent to `notexample[.]com`. Anyone who uses DENO_AUTH_TOKENS and imports potentially untrusted code is affected. Version 1.40.0 contains a patch for this issue
- Product
- deno
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2024Amazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html.CVE-2024-28823 · Other software · reported by MITREMedium 6.1
Amazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.