total.js@3.4.2 vulnerabilities
MVC framework for Node.js
-
latest version
3.4.13
-
first published
10 years ago
-
latest version published
2 years ago
-
licenses detected
- >=0
Direct Vulnerabilities
Known vulnerabilities in the total.js package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.Vulnerability | Vulnerable Version |
---|---|
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Arbitrary Code Execution via the PoC by Alessio Della Libera
NOTE: This vulnerability has also been identified as: CVE-2021-32831 How to fix Arbitrary Code Execution? Upgrade |
<3.4.9
|
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Arbitrary Code Execution via the PoC by Alessio Della Libera
NOTE: This vulnerability has also been identified as: CVE-2021-23389 How to fix Arbitrary Code Execution? Upgrade |
<3.4.9
|
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Remote Code Execution (RCE) via PoC
How to fix Remote Code Execution (RCE)? Upgrade |
<3.4.8
|
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Prototype Pollution. The PoC
How to fix Prototype Pollution? Upgrade |
<3.4.7
|
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Command Injection. The issue occurs in the PoC
How to fix Command Injection? Upgrade |
<3.4.7
|
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Improper Access Control. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The application correctly manages privileges only for the front-end resource path, and not for API requests. This leads to vertical and horizontal privilege escalation. How to fix Improper Access Control? There is no fixed version for |
>=3.1.0
|
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Improper Authentication via cookie enumeration. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with How to fix Improper Authentication? There is no fixed version for |
>=3.1.0
|
total.js is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. It can be used as web, desktop, service or IoT application. Affected versions of this package are vulnerable to Remote Code Execution (RCE). It is possible for an attacker to create a malicious widget with a special tag containing JavaScript code which will then be evaluated application. PoC by Riccardo Krauter How to fix Remote Code Execution (RCE)? There is no fixed version for |
>=3.1.0
|