1097 matches found
DOMPurify
DOMPurify DOMPurify es un sanitizador XSS exclusivo de DOM, ultrarrápido y extremadamente tolerante para HTML, MathML y SVG. También es muy sencillo de usar y de empezar a trabajar con él. DOMPurify fue iniciado en febrero de 2014 y, mientras tanto, ha alcanzado la versión v3.4.15. DOMPurify se...
CVE-2024-48910-PoC
CVE-2024-48910-PoC Resumen CVE-2024-48910 DOMPurify, un sanitizador XSS solo para DOM, súper rápido y ultra tolerante para HTML, MathML y SVG, se encontró vulnerable a la contaminación de prototipos CVE-2024-48910. La vulnerabilidad fue descubierta y corregida en la versión 2.4.2, con la...
CVE-2026-47423-dompurify-xss-detector
DOMPurify re-clone logic flaw. Instead of relying on easily stripped source comments or version variables, this tool performs logic fingerprinting on minified production JavaScript bundles to identify unpatched allowed-tag layouts. Vulnerability Summary In DOMPurify versions up to 3.4.4, the...
Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838
Summary IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Detai...
Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2024_8678)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20248678 advisory. golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 Tenable has extracted the preceding...
Rocky Linux 8 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2024_8327)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20248327 advisory. golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 dompurify: nesting-based mutation XSS vulnerability CVE-2024-47875 Tenable has extracted the preceding...
Rocky Linux 9 [CIQ] Security Update: grafana / grafana-debuginfo / grafana-debugsource / grafana-selinux Multiple Vulnerabilities (crlsa-2024_9473)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249473 advisory. encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-34156...
Security Bulletin: Vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer might affect IBM Storage Defender Copy Data Management
Summary IBM Storage Defender Copy Data Management can be affected by vulnerabilities in http-proxy-middleware,jackson-databind,uuid,Snakeyaml,Netty,DOMPurify,Micrometer. Vulnerabilities include a crafted Host header that is only a superstring match for a configured host+path key can still route a...
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
Summary In INPLACE mode DOMPurify sanitizes the caller's live DOM subtree directly. To close a known hazard GHSA-55q2-fjhq-7xh7, the library neutralizes any node a hook detaches during sanitization by stripping its subtree's non-allow-listed attributes, but this neutralization is wired only into...
Security Bulletin: IBM Maximo Application Suite uses dompurify-3.4.7.tgz which is vulnerable to CVE-2026-66010
Summary IBM Maximo Application Suite uses dompurify-3.4.7.tgz which is vulnerable to CVE-2026-66010. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElemen...
Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in DOMPurify (CVE-2026-41238, CVE-2026-41239, CVE-2026-41240)
Summary Multiple Cross-Site Scripting XSS vulnerabilities in DOMPurify CVE-2026-41238, CVE-2026-41239, CVE-2026-41240 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 3.4.12 on Windows and version 3.4.13 on Linux. Vulnerability Details...
CVE-2024-48910-POC
CVE-2024-48910 Prueba de Concepto Esta es una prueba de concepto para CVE-2024-48910. Esta es una vulnerabilidad que estaba presente en DOMPurify, un sanitizador XSS para HTML, SVG y MathML. Esta versión de DOMPurify es vulnerable a la contaminación de prototipos, donde un atacante puede inyectar...
Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)
Summary IBM DataPower Gateway has addressed CVE-2026-66010 in 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...
Security Bulletin: The Use Case Manager App for IBM QRadar SIEM contains components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Use Case Manager App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-65898 DESCRIPTION: DOMPurify befo...
Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i
Summary IBM Rational Developer for i is affected by cross-site scripting vulnerabilities in DOMPurify CVE-2026-65898, CVE-2026-65900, CVE-2026-65901, CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, CVE-2026-66010, and CVE-2026-75838, a protection mechanism failure vulnerability in DOMPurify...
Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in aircompressor, libarchive, gstreamer1, LIBPNG, bind9, giflib, react-router, dompurify
Summary IBM Optim version 1.0.0, 1.1.0 and 1.2.0 depends on open-source packages aircompressor, libarchive, gstreamer1, LIBPNG, bind9, giflib, react-router, dompurify which are affected by medium, high and critical severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by...
dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization
A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...
ROOT-APP-NPM-GHSA-CJMM-F4JC-QW8R GHSA-cjmm-f4jc-qw8r in dompurify - Patched by Root
Root has patched GHSA-cjmm-f4jc-qw8r in the dompurify package for Root:npm. Multiple fixed versions available...