CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-46234 – browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack
https://notcve.org/view.php?id=CVE-2023-46234
browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in `dsaVerify` function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2. browserify-sign es un paquete para duplicar la funcionalidad de las funciones de clave pública criptográfica del nodo, gran parte de esto se basa en el trabajo de Fedor Indutny en indutny/tls.js. Un problema de verificación de límite superior en la función `dsaVerify` permite a un atacante construir firmas que pueden verificarse con éxito mediante cualquier clave pública, lo que lleva a un ataque de falsificación de firmas. • https://github.com/browserify/browserify-sign/commit/85994cd6348b50f2fd1b73c54e20881416f44a30 https://github.com/browserify/browserify-sign/security/advisories/GHSA-x9w5-v3q2-3rhw https://lists.debian.org/debian-lts-announce/2023/10/msg00040.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HUE6ZR5SL73KHL7XUPAOEL6SB7HUDT2 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6PVVPNSAGSDS63HQ74PJ7MZ3MU5IYNVZ https://www.debian.org/security/2023/dsa-5539 https • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-37623
https://notcve.org/view.php?id=CVE-2022-37623
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable in resolve-shims.js. Vulnerabilidad de contaminación del prototipo en la función resolveShims en resolve-shims.js en thlorenz browserify-shim 3.8.15 a través de la variable shimPath en resolve-shims.js. • https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158 https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L94 https://github.com/thlorenz/browserify-shim/issues/248 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37621
https://notcve.org/view.php?id=CVE-2022-37621
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable in resolve-shims.js. Vulnerabilidad de contaminación del prototipo en la función resolveShims en resolve-shims.js en thlorenz browserify-shim 3.8.15 a través de la variable fullPath en resolve-shims.js. • https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158 https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L37 https://github.com/thlorenz/browserify-shim/issues/247 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-37617
https://notcve.org/view.php?id=CVE-2022-37617
Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resolve-shims.js. Una vulnerabilidad de contaminación de prototipos en la función resolveShims en el archivo resolve-shims.js en thlorenz browserify-shim versión 3.8.15 por medio de la variable k en resolve-shims.js • https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L130 https://github.com/thlorenz/browserify-shim/blob/464b32bbe142664cd9796059798f6c738ea3de8f/lib/resolve-shims.js#L158 https://github.com/thlorenz/browserify-shim/issues/245 • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-14730
https://notcve.org/view.php?id=CVE-2018-14730
An issue was discovered in Browserify-HMR. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:3123/ connection from any origin. Se ha descubierto un problema en Browserify-HMLR. Los atacantes pueden robar el código del desarrollado porque el origen de las peticiones no es comprobado por el servidor WebSocket, utilizado para HMR (Hot Module Replacement). • https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages https://github.com/AgentME/browserify-hmr/issues/41 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •