Cross site scripting

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

PYSEC-2024-35

Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

CVE-2024-21485

Dash Framework (Dash, dash-core-components, dash-html-components) versions before 2.15.0 (core components before 2.13.0/2.0.0; html components before 2.0.0/2.0.16) are vulnerable to Cross-site Scripting (XSS) when the href attribute of an anchor tag is controlled by an attacker. The vulnerability...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

buzzword (>=1.2.1, <=1.2.3), dash (2.0.0rc3) +22 more potentially affected by CVE-2024-21485 via dash-core-components (>=0.22.1, <=2.0.0rc1)

dash-core-components PYPI version =0.22.1, =1.2.1, =0.1.0, =2.0.0b0, =0.1.0, =0.1.0, =0.2.0, =0.0.2, =0.1.13 and more Source cves: CVE-2024-21485 Source advisory: MEND:CVE-2024-21485...

buzzword (>=1.2.1, <=1.2.3), dash (2.0.0rc3) +20 more potentially affected by CVE-2024-21485 via dash-html-components (>=0.10.0, <=2.0.0rc1)

dash-html-components PYPI version =0.10.0, =1.2.1, =0.1.0, =2.0.0b0, =0.1.0, =0.0.2, =1.1.0, =1.0.0.dev9, =1.0.2 and more Source cves: CVE-2024-21485 Source advisory: MEND:CVE-2024-21485...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

CVE-2024-21485

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

CVE-2024-21485: Improper Neutralization of Input During Web Page Generation

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable t...

Cross-site Scripting (XSS)

Overview dash-html-components is a Vanilla HTML components for Dash. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the...

Cross-site Scripting (XSS)

Overview dash-core-components is a Core component suite for Dash Affected versions of this package are vulnerable to Cross-site Scripting XSS when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data...

Cross-site Scripting (XSS)

Overview dash-html-components is a Vanilla HTML components for Dash. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-core-components (2.0.0rc1)

dash-core-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-core-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory:...

dash (2.0.0rc3), django-dash-ddx-catalog (>=0.1.2, <=0.1.3) potentially affected by CVE-2024-21485 via dash-html-components (2.0.0rc1)

dash-html-components PYPI version 2.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on dash-html-components and may be impacted: - dash 2.0.0rc3 - django-dash-ddx-catalog =0.1.2, =0.1.3 Source cves: CVE-2024-21485 Source advisory:...

Cross-site Scripting (XSS)

Overview dash-core-components is a library that provides the core React component suite for Dash. Affected versions of this package are vulnerable to Cross-site Scripting XSS when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this...

PT-2024-18904

Name of the Vulnerable Software and Affected Versions dash-core-components versions prior to 2.13.0 dash versions prior to 2.15.0 dash-html-components versions prior to 2.0.16 Description The issue allows an authenticated attacker to steal data visible to another user who opens a view that exploi...

CVE-2024-21888

A privilege escalation vulnerability in web component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows a user to elevate privileges to that of an administrator...

MAL-2024-950 Malicious code in diil-selfservice-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be3632254a6cd21edaffb63ace342ea00667ca30b7c8f9d01f929d76932adfb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in diil-selfservice-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...