Search for packages
| purl | pkg:npm/total.js@1.9.7-6 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-2pdw-fzpu-8yht
Aliases: CVE-2022-44019 |
There are no reported fixed by versions. | |
|
VCID-2vcv-em7r-4baf
Aliases: CVE-2019-10260 GHSA-72p5-2r6g-fm6v |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format). |
Affected by 6 other vulnerabilities. |
|
VCID-528e-s8wc-6ydu
Aliases: CVE-2021-23344 GHSA-3wj8-vp9h-rm6m |
Code Injection The package `total.js` is vulnerable to Remote Code Execution (RCE) via `set`. |
Affected by 3 other vulnerabilities. |
|
VCID-ch36-st1p-2khy
Aliases: CVE-2021-23389 GHSA-7fm6-gxqg-2pwr |
Code Injection The package total.js are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. |
Affected by 1 other vulnerability. |
|
VCID-gj61-mm9w-9ufd
Aliases: CVE-2019-8903 GHSA-3q32-j57w-q4w7 |
Path Traversal `index.js` in Total.js Platform allows path traversal. |
Affected by 7 other vulnerabilities. |
|
VCID-vfmh-kcfd-5fcm
Aliases: CVE-2021-32831 GHSA-vwhc-pww7-72x6 |
Code Injection Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed |
Affected by 1 other vulnerability. |
|
VCID-wmct-kms3-23hk
Aliases: CVE-2020-28494 GHSA-4449-hg37-77v8 |
Command Injection This affects the package `total.js` The issue occurs in the `image.pipe` and `image.stream` functions. The type parameter is used to build the command that is then executed using `child_process.spawn.` The issue occurs because `child_process.spawn` is called with the option shell set to true and because the type parameter is not properly sanitized. |
Affected by 4 other vulnerabilities. |
|
VCID-xkck-dyh3-cfaq
Aliases: CVE-2020-28495 GHSA-6cf8-qhqj-vjqm |
Improperly Controlled Modification of Object Prototype Attributes The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection. |
Affected by 4 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||