CVE-2024-47875 DOMPurify nesting-based mXSS

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3...

CVE-2024-47875

CVE-2024-47875 affects DOMPurify and is a nesting-based mXSS vulnerability in DOMPurify’s HTML/MathML/SVG sanitization. The initial entry notes fixes in DOMPurify versions 2.5.0 and 3.1.3. Connected sources further confirm the issue is tracked across ecosystems (e.g., node-dompurify), with Debian...

CVE-2024-47875 DOMPurify nesting-based mXSS

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3...

@3t-transform/threeteeui (>=1.5.1, <=1.12.3), @accelbyte/sdk-legal (>=0.0.0-dev-20240828032938, <=6.0.2) +293 more potentially affected by CVE-2024-47875 via dompurify (>=3.0.0, <=3.1.2)

dompurify NPM version =3.0.0, =1.5.1, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =1.2.0, =6.4.10, =5.1.1, =1.0.22, =1.0.12, =1.0.0, =1.0.22, =1.0.25, =0.0.1, =0.0.0-nightly-2021101222132, =0.9.4 and more Source cves: CVE-2024-47875 Source advisory: MEND:CVE-2024-47875...

@0xgg/echomd (>=1.0.0, <=1.0.4), @5lions/library-registry-admin (0.0.0) +1333 more potentially affected by CVE-2024-47875 via dompurify (>=0.6.6, <=2.4.9)

dompurify NPM version =0.6.6, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.13, =3.0.0, =2.2.0, =6.4.3, =0.0.2-next.4, =1.0.1, =0.6.0, =0.3.0, =0.1.0, =0.1.0-a0, =1.1.0 and more Source cves: CVE-2024-47875 Source advisory: MEND:CVE-2024-47875...

CVE-2024-47875: Improper Neutralization of Input During Web Page Generation

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3...

DOMPurify Cross-Site Scripting Vulnerability

DOMPurify is a DOM Document Object Model for HTML, MathML and SVG written in JavaScript by Cure53 Personal Developer. A cross-site scripting vulnerability exists in DOMPurify versions prior to 2.5.0 and prior to 3.1.3, which stems from vulnerability to cross-site scripting attacks...

Moderate: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Cross-site Scripting (XSS)

github.com/gotify/server is vulnerable to Cross-site Scripting XSS. The vulnerability is due to outdated Swagger UI, which uses a vulnerable version of DOMPurify, allowing an attacker to execute arbitrary JavaScript through external Swagger config files...

MAL-2024-9052 Malicious code in express-dompurify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91e7d551e697c3ae72eea274492e2bb8c59b0a5fabfff62717660304264ceae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in express-dompurify

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in express-dompurify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91e7d551e697c3ae72eea274492e2bb8c59b0a5fabfff62717660304264ceae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@chirper/mythiq (>=0.0.3, <=0.0.20), @cloudcommerce/storefront (>=0.10.0, <=0.11.0) +106 more potentially affected by CVE-2024-47061 via @udecode/plate-core (>=21.0.0, <=21.5.0)

@udecode/plate-core NPM version =21.0.0, =0.0.3, =0.10.0, =0.0.0-20240315110821, =12.0.0-beta.319, =0.28.0, =0.0.3, =0.6.9, =0.0.0-20230511135047, =0.0.0-20230511135047, =1.0.0, =0.0.4, =0.0.85, =0.0.89, =0.0.93 and more Source cves: CVE-2024-47061 Source advisory: OSV:GHSA-73RG-F94J-XVHX...

Cross Site Scripting(XSS)

DOMPurify is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper depth checking, which can be bypassed through special HTML nesting techniques and prototype pollution, allowing an attacker to execute malicious scripts in the victim's browser...

CVE-2024-45801

A flaw was found in DOMPurify. This issue may allow an attacker to use specially-crafted HTML to bypass the depth checking or use Prototype Pollution to weaken the depth check, which can lead to cross site scripting XSS attacks. Mitigation Mitigation for this issue is either not available or the...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7nohe/vite-plugin-vue-marked (0.2.1) +1059 more potentially affected by CVE-2024-45801 via dompurify (>=2.0.0, <=2.5.0)

dompurify NPM version =2.0.0, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.13, =6.2.3, =6.4.3, =0.0.2-next.4, =0.3.0, =0.1.0, =0.1.0-a0, =1.0.0, =0.4.0, =0.0.18, =0.0.32 and more Source cves: CVE-2024-45801 Source advisory: GHSA-MMHX-HMJR-R674...

@3t-transform/threeteeui (>=1.5.1, <=1.12.3), @accelbyte/sdk-legal (>=0.0.0-dev-20240828032938, <=6.0.2) +293 more potentially affected by CVE-2024-45801 via dompurify (>=3.0.0, <=3.1.2)

dompurify NPM version =3.0.0, =1.5.1, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =1.2.0, =6.4.10, =5.1.1, =1.0.22, =1.0.12, =1.0.0, =1.0.22, =1.0.25, =0.0.1, =0.0.0-nightly-2021101222132, =0.9.4 and more Source cves: CVE-2024-45801 Source advisory: GHSA-MMHX-HMJR-R674...

@3t-transform/threeteeui (>=1.5.1, <=1.12.3), @accelbyte/sdk-legal (>=0.0.0-dev-20240828032938, <=6.0.2) +293 more potentially affected by CVE-2024-45801 via dompurify (>=3.0.0, <=3.1.2)

dompurify NPM version =3.0.0, =1.5.1, =0.0.0-dev-20240828032938, =0.2.8-experimental.0, =1.2.0, =6.4.10, =5.1.1, =1.0.22, =1.0.12, =1.0.0, =1.0.22, =1.0.25, =0.0.1, =0.0.0-nightly-2021101222132, =0.9.4 and more Source cves: CVE-2024-45801 Source advisory: OSV:GHSA-MMHX-HMJR-R674...

GHSA-MMHX-HMJR-R674 DOMPurify allows tampering by prototype pollution

It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid XSS attack. Fixed by...

@0xgg/echomd (>=1.0.0, <=1.0.4), @7nohe/vite-plugin-vue-marked (0.2.1) +1059 more potentially affected by CVE-2024-45801 via dompurify (>=2.0.0, <=2.5.0)

dompurify NPM version =2.0.0, =1.0.0, =0.2.0-beta.9, =0.2.0-beta.13, =6.2.3, =6.4.3, =0.0.2-next.4, =0.3.0, =0.1.0, =0.1.0-a0, =1.0.0, =0.4.0, =0.0.18, =0.0.32 and more Source cves: CVE-2024-45801 Source advisory: OSV:GHSA-MMHX-HMJR-R674...