Export limit exceeded: 425824 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2021-26505

Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Hello.js Project
Products
Hello.js
CVE-2020-7741

Cross-site Scripting (XSS)

This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:alert(1).

CVSS 3.1 · 9.9 Critical EPSS 1.5% KEV · Not listed
Vendors
Hello.js Project
Products
Hello.js