| jquery09d07e20ce042ef10e301661ad1f316cFound in https://static.zdassets.com/hc/assets/jquery-09d07e20ce042ef10e301661ad1f316c.js _____Vulnerability info:mediumCVE-2011-4969 XSS with location.hash GHSA-579v-mp3v-rrw5123mediumCVE-2012-6708 11290 Selector interpreted as HTML GHSA-2pqj-h3vj-pqgw123mediumCVE-2020-7656 Versions of jquery prior to 1.9.0 are vulnerable to Cross-Site Scripting. The load method fails to recognize and remove “”, which results in the enclosed script logic to be executed. This allows attackers to execute arbitrary JavaScript in a victim’s browser. | Recommendation
Upgrade to version 1.9.0 or later. GHSA-q4m3-2j7h-f7xw12low73 jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates1moment.js2.15.2Found in https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.15.2/moment.min.js _____Vulnerability info:highRegular Expression Denial of Service (ReDoS) CVE-2017-18214 GHSA-446m-mv8f-q348123highThis vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale. CVE-2022-24785 GHSA-8hfj-j24r-96c41moment.js4ef0d82f9fc65c8a28f659aa3430955fFound in https://static.zdassets.com/hc/assets/moment-4ef0d82f9fc65c8a28f659aa3430955f.js _____Vulnerability info:mediumreDOS - regular expression denial of service 2936 GHSA-87vv-r9j6-g5qv CVE-2016-40551mediumRegular Expression Denial of Service (ReDoS) 221highRegular Expression Denial of Service (ReDoS) CVE-2017-18214 GHSA-446m-mv8f-q348123highThis vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale. CVE-2022-24785 GHSA-8hfj-j24r-96c41underscore.js1.8.3Found in https://support.brave.app/hc/theming_assets/01HZHBGEGBHA5EEVCVW0MA6Z8N _____Vulnerability info: | | | |
|----|----|----|----|----|
| |
Hi, Welcome to the Community! (Unless you’re maybe a bot?)
I might encourage you to edit and rewrite your post because I think most people who are going to look at it are just going to look at it, see a bunch of well really non-sense and move on… I understand you are pointing out there are some vulnerabilities, I would imagine Brave is aware of this and working on any vulnerabilities. If there is anything specifically you would like for Brave to address I’d encourage you to write it out clearly and not just copy and paste a bunch of things you want fixed.