js vulnerabilities