CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 0CVE-2023-28154 – webpack JS package <= 5.75.0 - Sandbox Bypass
https://notcve.org/view.php?id=CVE-2023-28154
13 Mar 2023 — Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object. A flaw was found in the webpack package, which could allow a remote attacker to bypass security restrictions caused by the mishandling of the magic comment feature by the ImportParserPlugin.js. This flaw allows an attacker to gain access to the real global object by sending a speci... • https://github.com/webpack/webpack/compare/v5.75.0...v5.76.0 • CWE-269: Improper Privilege Management •
CVSS: 10.0EPSS: 15%CPEs: 3EXPL: 2CVE-2022-37601 – loader-utils (JS package) < 2.0.3 - Prototype Pollution
https://notcve.org/view.php?id=CVE-2022-37601
12 Oct 2022 — Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. Una vulnerabilidad de contaminación de prototipos en la función parseQuery en el archivo parseQuery.js en webpack loader-utils 2.0.0 por medio de la variable name en parseQuery.js A prototype pollution vulnerability was found in the parseQuery function in parseQuery.js in the webpack loader-utils via the name variable in... • http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.8EPSS: 3%CPEs: 3EXPL: 0CVE-2022-37599 – loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service
https://notcve.org/view.php?id=CVE-2022-37599
11 Oct 2022 — A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the resourcePath variable in interpolateName.js. Se ha encontrado un fallo de Denegación de Servicio de Expresión Regular (ReDoS) en la función interpolateName en el archivo interpolateName.js en webpack loader-utils 2.0.0 por medio de la variable resourcePath en el archivo interpolateName.js A flaw was found in the interpolateName function in interpolateName.js i... • https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L38 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 2CVE-2022-37603 – loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service
https://notcve.org/view.php?id=CVE-2022-37603
11 Oct 2022 — A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js. Se ha encontrado un fallo de denegación de servicio de expresión Regular (ReDoS) en la función interpolateName en el archivo interpolateName.js en webpack loader-utils 2.0.0 por medio de la variable url en interpolateName.js A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, ... • https://github.com/webpack/loader-utils/blob/d9f4e23cf411d8556f8bac2d3bf05a6e0103b568/lib/interpolateName.js#L107 • CWE-185: Incorrect Regular Expression CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2018-14732
https://notcve.org/view.php?id=CVE-2018-14732
21 Sep 2018 — An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin. Se ha descubierto un problema en lib/Server.js en webpack-dev-server en versiones anteriores a la 3.1.6. Los atacantes pueden robar el código del desarr... • https://blog.cal1.cn/post/Sniffing%20Codes%20in%20Hot%20Module%20Reloading%20Messages • CWE-20: Improper Input Validation •