@dev-engage/engage-ionic (>=0.6.0, <=0.6.6), @ionic/angular (>=4.1.0-dev.201902122208.39fbc32, <=4.1.2) +2 more potentially affected by unknown CVE via @ionic/core (>=4.1.0, <=4.1.2-dev.201903141948.7d01207)

@ionic/core NPM version =4.1.0, =0.6.0, =4.1.0-dev.201902122208.39fbc32, =4.1.2 - @ionic/pwa-elements 1.0.2 - dos-wc-library 0.6.1 Source cves: unknown CVE Source advisory: OSV:GHSA-R3XC-47QG-H929...

@ccrpc/tip (>=0.1.0, <=0.3.2), @ccrpc/webmapgl (>=0.10.0, <=0.13.0) +6 more potentially affected by unknown CVE via @ionic/core (4.2.0-dev.201904092340.3a643a3)

@ionic/core NPM version 4.2.0-dev.201904092340.3a643a3 is affected by a known vulnerability. The following packages have a transitive dependency on @ionic/core and may be impacted: - @ccrpc/tip =0.1.0, =0.10.0, =4.2.0, =4.2.0, =4.2.0-dev.201903262032.a8a48a4, =2.2.3-alpha.0, =0.9.0, =0.12.2 -...

Cross-Site Scripting in @ionic/core

Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the components: ...

@ionic/angular (>=4.3.0-dev.201904161617.4474974, <=4.3.0), dos-wc-library (>=0.7.7, <=0.7.21) potentially affected by unknown CVE via @ionic/core (4.3.0-dev.201904171418.07e739a)

@ionic/core NPM version 4.3.0-dev.201904171418.07e739a is affected by a known vulnerability. The following packages have a transitive dependency on @ionic/core and may be impacted: - @ionic/angular =4.3.0-dev.201904161617.4474974, =0.7.7, =0.7.21 Source cves: unknown CVE Source advisory:...

GHSA-R3XC-47QG-H929 Cross-Site Scripting in @ionic/core

Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the components: ...

Cross-site Scripting (XSS)

@ionic/core is vulnerable to cross-site scripting XSS. The attack exists because the unsafe innerHTML function is rendered directly on the alert-message string with the following components: .message,.placeholder, .loadingText, .pullingText, .refershingText...

Cross-Site Scripting

Overview Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the...