Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2018-19837
Good to know:
Date: December 4, 2018
In LibSass prior to 3.5.5, Sass::Eval::operator()(Sass::Binary_Expression*) inside eval.cpp allows attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, because of certain incorrect parsing of '%' as a modulo operator in parser.cpp.
Language: JS
Severity Score
Related Resources (7)
Severity Score
Weakness Type (CWE)
Uncontrolled Resource Consumption
CWE-400Top Fix
Upgrade Version
Upgrade to version kayrules/solatjakim-api-site - dev-version-1.0;oburatongoi/productivity - 0.0.13;oburatongoi/productivity - no_fix;oburatongoi/productivity - 0.0.1;ilhanet/erpnet-widget-resource - no_fix;pwptemplatepusintek - no_fix;oxid-esales/wave-theme - dev-oxscript-google-analytics;angellco/spoon - 3.2.5;mmi/mmi-cms - 2.3.1;zymawy/ironside-core - dev-utils;seidemann-web/wave-theme - dev-fixUpLanguageConstants;seidemann-web/wave-theme - dev-omage-theme;seidemann-web/wave-theme - no_fix;seidemann-web/wave-theme - dev-WT-36/Sticky-Header-Fixes;files.com/files-php-sdk - v1.0.7;MIDIator.WebClient - 1.0.105;doublesecretagency/craft-spoon - 3.2.5;chrisbraybrooke/laravel-ecommerce - dev-form-field-key;chrisbraybrooke/laravel-ecommerce - 0.0.17;chrisbraybrooke/laravel-ecommerce - 0.0.2;chrisbraybrooke/laravel-ecommerce - 0.0.56;PWPTemplateCMS - no_fix;node-sass - 4.14.0;trezebits/trezevel-gallery - no_fix;tombeachell/forza-magento - no_fix;Fable.Template.Elmish.React - 0.1.6;org.webjars.npm:node-sass:4.11.0;org.webjars.npm:bourbon-neat:2.1.0
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | REQUIRED |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | HIGH |
CVSS v2
| Base Score: |
|
|---|---|
| Access Vector (AV): | NETWORK |
| Access Complexity (AC): | MEDIUM |
| Authentication (AU): | NONE |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | PARTIAL |
| Additional information: |