CVE-2020-26870

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

CVE-2020-26870

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

@5lions/library-registry-admin (0.0.0), @adobe/helix-cli (>=3.0.0, <=5.2.0) +365 more potentially affected by CVE-2020-26870 via dompurify (>=0.6.6, <=2.0.15)

dompurify NPM version =0.6.6, =3.0.0, =2.2.0, =0.0.2-next.4, =1.0.1, =0.6.0, =1.0.0, =0.1.0, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.15.0, =0.7.3-dev, =0.7.9 and more Source cves: CVE-2020-26870 Source advisory: MEND:CVE-2020-26870...

CVE-2020-26870

CVE-2020-26870 affects DOMPurify up to 2.0.16/2.0.17, where a serialize-parse roundtrip can alter the DOM (namespace changes HTML→MathML, e.g., nesting FORM elements), enabling a mutation XSS. The issue is documented by Cure53 and linked analyses; a fix was released with DOMPurify 2.0.17. Related...

CVE-2020-26870

Removed by vendor...

CVE-2020-26870: Improper Neutralization of Input During Web Page Generation

Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements...

PT-2020-5443

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.0.17 Description The issue is related to the DOMPurify library and its failure to protect the structure of a web page. This can be exploited by a remote attacker to perform a cross-site scripting attack...

Cross-Site Scripting in dompurify

Versions of dompurify prior to 2.0.7 are vulnerable to Cross-Site Scripting XSS. It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 2.0.7 or later...

@adpt/testutils (>=0.0.2-next.4, <=0.1.0-next.1), @elliemae/pui-cli (>=0.0.1, <=0.0.2-beta.7) +10 more potentially affected by unknown CVE via dompurify (>=2.0.0, <=2.0.5)

dompurify NPM version =2.0.0, =0.0.2-next.4, =0.0.1, =4.3.1-test1, =6.3.5, =8.1.1, =2.4.13-dev-verdaccio.1070, =0.0.1, =0.1.0, =0.0.1, =2.0.0, =2.1.0, =3.13.0, =4.3.3 Source cves: unknown CVE Source advisory: GHSA-MJJQ-C88Q-QHR6...

GHSA-MJJQ-C88Q-QHR6 Cross-Site Scripting in dompurify

Versions of dompurify prior to 2.0.7 are vulnerable to Cross-Site Scripting XSS. It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 2.0.7 or later...

@adpt/testutils (>=0.0.2-next.4, <=0.1.0-next.1), @elliemae/pui-cli (>=0.0.1, <=0.0.2-beta.7) +10 more potentially affected by unknown CVE via dompurify (>=2.0.0, <=2.0.5)

dompurify NPM version =2.0.0, =0.0.2-next.4, =0.0.1, =4.3.1-test1, =6.3.5, =8.1.1, =2.4.13-dev-verdaccio.1070, =0.0.1, =0.1.0, =0.0.1, =2.0.0, =2.1.0, =3.13.0, =4.3.3 Source cves: unknown CVE Source advisory: OSV:GHSA-MJJQ-C88Q-QHR6...

PT-2020-21409

Name of the Vulnerable Software and Affected Versions dompurify versions prior to 2.0.7 Description The issue allows an attacker to bypass the package sanitization through Mutation XSS, potentially enabling the execution of arbitrary JavaScript in a victim's browser. Recommendations Upgrade to...

Cross-Site Scripting in dompurify

Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting XSS. The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of / elements and /. An example payload is: ". This allows attackers to bypass the XSS protection and execute...

GHSA-CHQJ-J4FH-RW7M Cross-Site Scripting in dompurify

Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting XSS. The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of / elements and /. An example payload is: ". This allows attackers to bypass the XSS protection and execute...

@elliemae/pui-cli (>=0.0.1, <=0.0.2-beta.4), react-native-github-markdown (>=2.1.0, <=2.2.0) potentially affected by CVE-2019-16728 via dompurify (>=2.0.0, <=2.0.2)

dompurify NPM version =2.0.0, =0.0.1, =2.1.0, =2.2.0 Source cves: CVE-2019-16728 Source advisory: GHSA-CHQJ-J4FH-RW7M...

@elliemae/pui-cli (>=0.0.1, <=0.0.2-beta.4), react-native-github-markdown (>=2.1.0, <=2.2.0) potentially affected by CVE-2019-16728 via dompurify (>=2.0.0, <=2.0.2)

dompurify NPM version =2.0.0, =0.0.1, =2.1.0, =2.2.0 Source cves: CVE-2019-16728 Source advisory: OSV:GHSA-CHQJ-J4FH-RW7M...

XSS via JQLite DOM manipulation functions in AngularJS

Summary XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element. Description JQLite DOM manipulation library...

GHSA-JPCQ-CGW6-V4J6 Potential XSS vulnerability in jQuery

Impact Passing HTML containing elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches This problem is patched in jQuery 3.5.0. Workarounds To workaround this issue without...

Potential XSS vulnerability in jQuery

Impact Passing HTML containing elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches This problem is patched in jQuery 3.5.0. Workarounds To workaround this issue without...

PT-2020-4421

Name of the Vulnerable Software and Affected Versions: jQuery versions 1.0.3 through 3.4.1 Description: The issue arises from insufficient cleaning of user-provided data when passing HTML elements to jQuery's DOM manipulation methods, such as .html and .append. This can allow an attacker to execu...