CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642: Improper Neutralization of Input During Web Page Generation

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

PT-2020-19677

Name of the Vulnerable Software and Affected Versions lazysizes versions through 5.2.0 Description The issue allows execution of malicious JavaScript. The video-embed plugin does not sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube, and data-ytparams, which can be...

Cross-site Scripting (XSS)

Overview lazysizes is a fast jank-free, SEO-friendly and self-initializing lazyloader for images including responsive images picture/srcset, iframes, scripts/widgets and much more. It also prioritizes resources by differentiating between crucial in view and near view elements to make perceived...

Cross-Site Scripting

Overview Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if...

Server-Side Request Forgery (SSRF)

ghost is vulnerable to server-side request forgery SSRF. An attacker with the publisher role editor, author, contributor, administrator in a blog is able to exploit the vulnerability in the embed content module to make arbitrary GET requests in a on behalf of the server, allowing discovery of...

Cross-Site Scripting (XSS)

lazysizes is vulnerable to cross-site scripting XSS. The attributes data-vimeo, data-vimeoparams, data-youtube and data-ytparams are not sanitized by the video-embed plugin, allowing a remote attacker to inject and execute arbitrary Javascript in the user's browser via the affected parameters...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.99), org.apache.tomcat.embed:tomcat-embed-websocket (7.0.99) +1 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (7.0.99)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.99 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.99 -...

cn.springboot:best-pay-sdk (>=1.3.3, <=1.3.7), com.aceql:aceql-http (>=4.0, <=4.1) +42 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.49, <=8.5.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.49, =1.3.3, =4.0, =3.0.6, =3.0.6, =3.0.6, =3.0.6, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.11 - com.heroku:webapp-runner 8.5.50.0 and more Source cves: CVE-2019-17569 Source advisory: OSV:GHSA-767J-JFH2-JVRC...

ai.hyacinth.framework:core-service-admin-server (0.5.24), ai.hyacinth.framework:core-service-config-server (0.5.24) +831 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.29, <=9.0.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.29, =0.0.1, =1.6, =1.8 - cloud.altemista.fwk.framework:cloud-altemistafwk-boot-conf 3.1.0.release - cloud.altemista.fwk.framework:cloud-altemistafwk-documentation 3.1.0.release -...

ai.hyacinth.framework:core-service-admin-server (0.5.24), ai.hyacinth.framework:core-service-config-server (0.5.24) +831 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.29, <=9.0.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.29, =0.0.1, =1.6, =1.8 - cloud.altemista.fwk.framework:cloud-altemistafwk-boot-conf 3.1.0.release - cloud.altemista.fwk.framework:cloud-altemistafwk-documentation 3.1.0.release -...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.99), org.apache.tomcat.embed:tomcat-embed-websocket (7.0.99) +1 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (7.0.99)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.99 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.99 -...

cn.springboot:best-pay-sdk (>=1.3.3, <=1.3.7), com.aceql:aceql-http (>=4.0, <=4.1) +42 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.49, <=8.5.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.49, =1.3.3, =4.0, =3.0.6, =3.0.6, =3.0.6, =3.0.6, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.11 - com.heroku:webapp-runner 8.5.50.0 and more Source cves: CVE-2019-17569 Source advisory: GHSA-767J-JFH2-JVRC...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.29) +285 more potentially affected by CVE-2020-1935 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.99)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2020-1935 Source advisory: GHSA-QXF4-CHVG-4R8R...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4542 more potentially affected by CVE-2020-1935 via org.apache.tomcat.embed:tomcat-embed-core (>=8.0.1, <=8.5.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.0.1, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =1, =10 and more Source cves: CVE-2020-1935 Source advisory: GHSA-QXF4-CHVG-4R8R...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +3366 more potentially affected by CVE-2020-1935 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =4.4.0.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 - ai.ylyue:yue-library-web 2.1.0 and more Source cves: CVE-2020-1935 Source...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.29) +285 more potentially affected by CVE-2020-1935 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.99)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2020-1935 Source advisory: OSV:GHSA-QXF4-CHVG-4R8R...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4542 more potentially affected by CVE-2020-1935 via org.apache.tomcat.embed:tomcat-embed-core (>=8.0.1, <=8.5.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.0.1, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =1, =10 and more Source cves: CVE-2020-1935 Source advisory: OSV:GHSA-QXF4-CHVG-4R8R...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (>=0.5.0, <=0.5.24) +3366 more potentially affected by CVE-2020-1935 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =4.4.0.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 - ai.ylyue:yue-library-web 2.1.0 and more Source cves: CVE-2020-1935 Source...