R4356Th

Deno, a JavaScript, TypeScript, and WebAssembly runtime, is susceptible to Command Line Injection attacks on Windows operating systems when batch files are executed. The Windows operating system implicitly uses `cmd.exe` when executing batch files, even if not explicitly specified, creating a pathway for attackers to inject malicious commands through user input. Approximately 654 systems are estimated to be affected, and over 1,300 services are found annually. The vulnerability resides in the way Deno handles the `CreateProcess()` function when executing batch files on Windows. The `CreateProcess()` function is used to create a new process, and in the case of batch files, it automatically invokes `cmd.exe`. This behavior allows attackers to inject commands into the batch file, which are then executed by `cmd.exe`.

A security issue exists in Parcel that allows malicious websites to send XMLHTTPRequests to the application's development server and read the response, potentially leading to source code theft when developers visit these websites. This occurs during developer activity while working on a project with the Parcel dev server running.

This issue is similar to a previously known vulnerability. When running a Next.js server locally, the WebSocket server is susceptible to Cross-site WebSocket hijacking (CSWSH) attacks. If a user visits a malicious link while the Next.js dev server is running, a bad actor may access the source code of client components. This affects applications using App Router, which was experimental in versions 13.0.0 to 13.3.x. The vulnerability allows an attacker to spy on dev activity and steal source code.

Name of the Vulnerable Software and Affected Versions: Koa versions prior to 0.21.2 Koa versions prior to 1.7.1 Koa versions prior to 2.15.4 Koa versions prior to 3.0.0-alpha.3 Description: The issue concerns a Denial-of-Service attack due to Koa using an evil regex to parse the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers. This can be exploited to carry out a Denial-of-Service attack, causing memory exhaustion. Recommendations: For versions prior to 0.21.2, update to version 0.21.2 or later. For versions prior to 1.7.1, update to version 1.7.1 or later. For versions prior to 2.15.4, update to version 2.15.4 or later. For versions prior to 3.0.0-alpha.3, update to version 3.0.0-alpha.3 or later. As a temporary workaround, consider restricting access to the `X-Forwarded-Proto` and `X-Forwarded-Host` HTTP headers until a patch is available.

The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, where an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page.

The issue is related to the UnlinkedWikibase extension in MediaWiki, where improper neutralization of input during web page creation can lead to cross-site scripting (XSS) attacks. This can allow a remote attacker to perform XSS attacks through an interface message. Error messages, stored in the `$err` variable, are not escaped before being passed to `Html::rawElement()` in the `getError()` function of the Hooks class.

An issue was discovered in MediaWiki that allows CSRF through MassEditRegex.