Lucene search
GoogleOSV:GHSA-HG2P-2CVQ-4PPVHistoryDec 10, 2021 - 8:06 p.m.
Cross-site scripting in lazysizes
2021-12-1020:06:23
Google
osv.dev
10
lazysizes
version 5.2.0
malicious javascript
video-embed plugin
data-vimeo
data-vimeoparams
data-youtube
data-ytparams
javascript injection
EPSS
0.001
Percentile
21.6%
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
Related
veracode
veracode
Cross-Site Scripting (XSS)
2020-03-10 02:51:53
cve
cve
CVE-2020-7642
2020-04-22 16:15:13
cvelist
cvelist
CVE-2020-7642
2020-04-22 15:13:51
prion
prion
Design/Logic Flaw
2020-04-22 16:15:00
osv
osv
CVE-2020-7642
2020-04-22 16:15:13
github
github
Cross-site scripting in lazysizes
2021-12-10 20:06:23
nvd
nvd
CVE-2020-7642
2020-04-22 16:15:13