DOMPurify Cross-Site Scripting Vulnerability

DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A cross-site scripting vulnerability exists in versions of DOMPurify prior to 2.0.1, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker...

CVE-2019-16728

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

CVE-2019-16728

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

UBUNTU-CVE-2019-16728

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

CVE-2019-16728

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

Cross site scripting

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

CVE-2019-16728

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

@5lions/library-registry-admin (0.0.0), @adobe/helix-cli (>=3.0.0, <=5.2.0) +308 more potentially affected by CVE-2019-16728 via dompurify (>=0.6.6, <=2.0.2)

dompurify NPM version =0.6.6, =3.0.0, =2.2.0, =1.0.1, =0.6.0, =0.1.0, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.15.0, =0.7.3-dev, =0.7.3-dev, =0.7.8 - @atom-ide-community/nuclide-watchman-helpers 0.7.3-dev and more Source cves: CVE-2019-16728 Source advisory: MEND:CVE-2019-16...

CVE-2019-16728

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

CVE-2019-16728

Summary: CVE-2019-16728 affects DOMPurify prior to 2.0.1, enabling cross-site scripting via innerHTML mutation XSS (mXSS) in SVG or MATH elements, demonstrated in Chrome and Safari. Affected component: DOMPurify (HTML, MathML, SVG sanitization code). Root cause: improper handling of innerHTML mut...

CVE-2019-16728

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

CVE-2019-16728: Improper Neutralization of Input During Web Page Generation

DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...

PT-2019-14797

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.0.3 DOMPurify versions prior to 2.0.1 Description The issue allows for Cross-Site Scripting XSS due to innerHTML mutation XSS mXSS for an SVG element or a MATH element. This can be demonstrated in browsers like...

@amory/patch-gatsby (>=2018.4.29-8, <=2018.5.11-5), @amory/patches (>=2018.5.11-6, <=2018.5.23-7) +227 more potentially affected by CVE-2018-6341 via react-dom (>=16.3.0, <=16.3.2)

react-dom NPM version =16.3.0, =2018.4.29-8, =2018.5.11-6, =2.0.0-rc.2, =0.0.5, =0.0.1, =1.9.1, =1.3.2, =1.6.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.3.2, =1.1.0, =1.1.3 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

Cross-site Scripting (XSS)

dompurify is vulnerable to cross-site scripting vulnerability. It is possible because of a broken logical check in handling both the recent Safari DOMParser XSS and a Firefox mXSS...

Nextcloud: DOMPurify 0.8.9 released

Got the following via the DOMPurify-Security mailing list: Intro A new version of DOMPurify was released today: DOMPurify 0.8.9 Background DOMPurify showed weaknesses when handling both the recent Safari DOMParser XSS and a Firefox mXSS when working with document.write. Caused by a broken logical...

Cross-site Scripting (XSS)

dompurify is vulnerable to cross-site scripting XSS attacks. The attacks are possible because it does not sanitize strings properly. Attackers can launch a XSS via new DOMParser.parseFromString'', 'text/html'; in Safari browser versions 10.1/10.2...

PT-2024-6805

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.5.0 DOMPurify versions prior to 3.1.3 Description The issue is related to insufficient input validation in the DOMPurify JavaScript library, which can lead to a cross-site scripting XSS attack. This vulnerability...