Mail.ru: [XSS] data-url в письмах

XSS via DOM clobbering on message reading functionality...

@akiolabs/analytics (>=0.0.3, <=0.0.4), @akiolabs/app (>=0.0.2, <=0.0.4) +221 more potentially affected by CVE-2018-6341 via react-dom (>=16.4.0, <=16.4.1)

react-dom NPM version =16.4.0, =0.0.3, =0.0.2, =0.0.1, =2018.5.24-0, =2018.6.17-2, =2018.7.11-0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.0-beta.0, =0.0.2, =0.0.22-alpha.1, =1.1.0, =1.0.0, =1.6.1 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

Mail.ru: XSS in e.mail.ru

XSS via dom clobbering on message reply composing...

GHSA-FX46-WHRJ-73V5 Bypassing Sanitization using DOM clobbering in html-janitor

All versions of html-janitor are vulnerable to cross-site scripting XSS. Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous XSS in case user-controlled input is passed to the clean function." Recommendation Upgrade to version 2.0.4 or later...

Mail.ru: XSS в теле письма, в новой версии почты.

DOM clobbering in new "Octavius" interface beta feature led to stored XSS on message reading...

Bypassing Sanitization using DOM clobbering

Overview All versions of html-janitor are vulnerable to cross-site scripting XSS. Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous XSS in case user-controlled input is passed to the clean function." Recommendation Upgrade to version 2.0.4 or later. Reference...

Cross-site Scripting (XSS)

html-janitor is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary HTML through DOM clobbering...

Node.js third-party modules: [html-janitor] Bypassing sanitization using DOM clobbering

Module: Name: html-janitor Version: 2.0.2 Summary: Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous XSS in case user-controlled input is passed to the clean function. Description: Proof of concept: javascript var myJanitor = new HTMLJanitortags:p:; var...

paraview-glance (>=1.0.0, <=1.1.13), paraviewweb (>=1.9.0, <=2.5.29) +3 more potentially affected by CVE-2017-1000006 via plotly.js (>=1.12.0, <=1.14.0)

plotly.js NPM version =1.12.0, =1.0.0, =1.9.0, =1.0.0, =1.0.0, =1.0.6 - vue-admin 0.0.1 Source cves: CVE-2017-1000006 Source advisory: OSV:GHSA-2FQV-H3R5-M4VF...