Vulnerabilities > Openjsf

DATE CVE VULNERABILITY TITLE RISK
2024-10-29 CVE-2024-10491 Unspecified vulnerability in Openjsf Express
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used. The issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources. This vulnerability is especially relevant for dynamic parameters.
network
low complexity
openjsf
5.3
2024-09-10 CVE-2024-45590 Unspecified vulnerability in Openjsf Body-Parser
body-parser is Node.js body parsing middleware.
network
low complexity
openjsf
7.5
2024-09-10 CVE-2024-43796 Cross-site Scripting vulnerability in Openjsf Express
Express.js minimalist web framework for node.
network
high complexity
openjsf CWE-79
4.7
2024-09-10 CVE-2024-43800 Cross-site Scripting vulnerability in Openjsf Serve-Static
serve-static serves static files.
network
high complexity
openjsf CWE-79
4.7
2022-11-26 CVE-2022-24999 qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
network
low complexity
qs-project openjsf debian
7.5
2020-06-15 CVE-2020-4051 In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1.15.4, and greater than or equal to 1.16.0 and less than 1.16.3, there is a cross-site scripting vulnerability in the Editor's LinkDialog plugin.
network
low complexity
openjsf debian netapp
5.4
2017-08-09 CVE-2014-6393 Cross-site Scripting vulnerability in Openjsf Express
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
network
low complexity
openjsf CWE-79
6.1
2017-01-23 CVE-2015-8856 Cross-site Scripting vulnerability in Openjsf Serve-Index
Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.
network
low complexity
openjsf CWE-79
6.1