CVE-2024-45801: Inefficient Regular Expression Complexity

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the...

DOMPurify 安全漏洞

DOMPurify is a DOM Document Object Model for HTML, MathML and SVG written in JavaScript by Cure53 Personal Developer. A security vulnerability exists in DOMPurify versions prior to 2.5.4 and prior to 3.1.3, which stems from malicious HTML using a special nesting technique to bypass the depth...

CVE-2024-41808 OpenObserve stored XSS vulnerability may lead to complete account takeover

The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. ...

CVE-2024-41808 OpenObserve stored XSS vulnerability may lead to complete account takeover

The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. ...

CVE-2024-41808 OpenObserve stored XSS vulnerability may lead to complete account takeover

The OpenObserve open-source observability platform provides the ability to filter logs in a dashboard by the values uploaded in a given log. However, all versions of the platform through 0.9.1 do not sanitize user input in the filter selection menu, which may result in complete account takeover. ...

@ifanrx/dashboard (>=0.1.1, <=1.3.0), @ithinkdt/editor (>=3.4.11, <=3.5.1) +1 more potentially affected by CVE-2024-38356 via tinymce (>=7.0.1, <=7.1.2)

tinymce NPM version =7.0.1, =0.1.1, =3.4.11, =3.0.7-9, =3.4.0 Source cves: CVE-2024-38356 Source advisory: OSV:GHSA-9HCV-J9PV-QMPH...

@arkxio/ark-ui (>=0.1.0, <=0.1.23), @arkxio/ark-ui-src (0.1.0) +39 more potentially affected by CVE-2024-38357 via tinymce (>=6.0.0, <=6.8.3)

tinymce NPM version =6.0.0, =0.1.0, =0.1.19, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.7 and more Source cves: CVE-2024-38357 Source advisory: OSV:GHSA-W9JX-4G6G-RP7X...

PT-2024-7008

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.5.4 DOMPurify versions prior to 3.1.3 Description The issue is related to the DOMPurify library, which is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML, and SVG. It has been discovered that...

@ampproject/worker-dom (>=0.1.0, <=0.9.0), @atom-ide-community/nuclide-adb (>=0.7.3-dev, <=0.7.8) +39 more potentially affected by CVE-2019-25155 via dompurify (>=1.0.3, <=1.0.10)

dompurify NPM version =1.0.3, =0.1.0, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.15.0, =0.7.3-dev, =0.7.3-dev, =1.0.1, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.12 and more Source cves: CVE-2019-25155 Source advisory: OSV:GHSA-8HGG-XXM5-3873...

DOMPurify Open Redirect vulnerability

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...

GHSA-8HGG-XXM5-3873 DOMPurify Open Redirect vulnerability

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...

Reverse Tabnabbing

DOMPurify is vulnerable to reverse tabnabbing. The vulnerability is due to a missing rel="noopener noreferrer" attribute on links that use the target="blank" attribute. This can potentially lead to Phishing Attacks...

CVE-2019-25155

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...

CVE-2019-25155

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...

Code injection

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...

UBUNTU-CVE-2019-25155

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...

CVE-2019-25155

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...

DOMPurify Security Vulnerability

DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A security vulnerability exists in versions of DOMPurify prior to 1.0.11, which stems from a missing attribute for links...

CVE-2019-25155

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...

CVE-2019-25155: URL Redirection to Untrusted Site

DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attribute...