DOMPurify 安全漏洞

DOMPurify is a DOM Document Object Model for HTML, MathML and SVG written in JavaScript by Cure53 Personal Developer. A security vulnerability exists in DOMPurify versions prior to 2.5.4 and prior to 3.1.3, which stems from malicious HTML using a special nesting technique to bypass the depth...

PT-2024-7008

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.5.4 DOMPurify versions prior to 3.1.3 Description The issue is related to the DOMPurify library, which is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML, and SVG. It has been discovered that...

@5lions/library-registry-admin (=0.0.0), @ampproject/worker-dom (>=0.2.18 <=0.9.0) +51 more potentially affected by CVE-2019-25155 via dompurify (>=0.6.6 <=1.0.10)

dompurify NPM version =0.6.6, =0.2.18, =0.0.11, =0.8.8, =0.0.1, =0.7.2, =0.0.1, =1.0.2, =0.0.1, =0.9.7, =1.0.0, =1.1.0 and more Source cves: CVE-2019-25155 Source advisory: OSV:GHSA-8HGG-XXM5-3873...

Server side request forgery in SwaggerUI

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered...

The vulnerability of the DOMPurify library, related to the lack of protective measures for the structure of web pages, allows attackers to execute cross-site scripting attacks.

The vulnerability of the DOMPurify library is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability can allow an attacker operating remotely to perform a cross-site scripting attack...

@5lions/library-registry-admin (=0.0.0), @adobe/helix-cli (>=3.0.0 <=5.2.0) +366 more potentially affected by unknown CVE via dompurify (>=0.6.6 <=2.0.5)

dompurify NPM version =0.6.6, =3.0.0, =2.2.0, =0.0.2, =1.0.1, =0.6.0, =0.1.0, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.15.0, =0.7.3-dev, =0.7.3-dev, =0.7.8 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MJJQ-C88Q-QHR6...