Güncel Güvenlik Açıkları

The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks. Devamını Oku

All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function. Devamını Oku

This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input. Devamını Oku

This affects the package elFinder.AspNet before 1.1.1. The user-controlled file name is not properly sanitized before it is used to create a file system path. Devamını Oku

This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code. Devamını Oku

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g __proto__, toString, etc) results in a returned object with a modified prototype instance. Devamını Oku

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization. Devamını Oku

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer. Devamını Oku

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack. Devamını Oku

All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input. Devamını Oku

All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input. Devamını Oku

All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. Devamını Oku