728 matches found
@5lions/library-registry-admin (=0.0.0), @adobe/helix-cli (>=3.0.0 <=5.2.0) +366 more potentially affected by unknown CVE via dompurify (>=0.6.6 <=2.0.5)
dompurify NPM version =0.6.6, =3.0.0, =2.2.0, =0.0.2, =1.0.1, =0.6.0, =0.1.0, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.15.0, =0.7.3-dev, =0.7.3-dev, =0.7.8 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MJJQ-C88Q-QHR6...
Cross-Site Scripting in dompurify
Versions of dompurify prior to 2.0.7 are vulnerable to Cross-Site Scripting XSS. It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 2.0.7 or later...
GHSA-MJJQ-C88Q-QHR6 Cross-Site Scripting in dompurify
Versions of dompurify prior to 2.0.7 are vulnerable to Cross-Site Scripting XSS. It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 2.0.7 or later...
Cross-Site Scripting in dompurify
Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting XSS. The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of / elements and /. An example payload is: ". This allows attackers to bypass the XSS protection and execute...
GHSA-CHQJ-J4FH-RW7M Cross-Site Scripting in dompurify
Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting XSS. The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of / elements and /. An example payload is: ". This allows attackers to bypass the XSS protection and execute...
@5lions/library-registry-admin (=0.0.0), @adobe/helix-cli (>=3.0.0 <=5.2.0) +358 more potentially affected by CVE-2019-16728 via dompurify (>=0.6.6 <=2.0.2)
dompurify NPM version =0.6.6, =3.0.0, =2.2.0, =1.0.1, =0.6.0, =0.1.0, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.7.3-dev, =0.15.0, =0.7.3-dev, =0.7.3-dev, =0.7.8 - @atom-ide-community/nuclide-watchman-helpers =0.7.3-dev and more Source cves: CVE-2019-16728 Source advisory:...
XSS via JQLite DOM manipulation functions in AngularJS
Summary XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith, JQLite.append, new JQLite and angular.element. Description JQLite DOM manipulation library...
Potential XSS vulnerability in jQuery
Impact Passing HTML containing elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches This problem is patched in jQuery 3.5.0. Workarounds To workaround this issue without...
GHSA-JPCQ-CGW6-V4J6 Potential XSS vulnerability in jQuery
Impact Passing HTML containing elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches This problem is patched in jQuery 3.5.0. Workarounds To workaround this issue without...
PT-2020-4421
Name of the Vulnerable Software and Affected Versions: jQuery versions 1.0.3 through 3.4.1 Description: The issue arises from insufficient cleaning of user-provided data when passing HTML elements to jQuery's DOM manipulation methods, such as .html and .append. This can allow an attacker to execu...
Potential XSS vulnerability in jQuery
Impact Passing HTML containing elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Workarounds To workaround this issue without upgrading, use DOMPurify with its SAFEFORJQUERY option...
PT-2020-6938 · Jquery · Jquery
Name of the Vulnerable Software and Affected Versions: jQuery versions 2.2.0 through 3.5.0 Description: The issue is related to Cross Site Scripting vulnerability, which allows a remote attacker to execute arbitrary code via the element. Passing HTML containing elements from untrusted sources to...
Cross-Site Scripting
Overview Versions of dompurify prior to 2.0.7 are vulnerable to Cross-Site Scripting XSS. It is possible to bypass the package sanitization through Mutation XSS, which may allow an attacker to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 2.0.7 or later...
Cross-Site Scripting
Overview Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting XSS. The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of / elements and /. An example payload is: ". This allows attackers to bypass the XSS protection and...
New Relic: Stored XSS at Mobile (Versions tab)
Hey team, I've discovered stored XSS rendered at Mobile inside the Versions tab working at least at latest Safari and latest Chrome MacOS. Steps to reproduce: 1 Sign into Mobile with some account which can edit the mobile applications 2 Navigate to some active mobile app, then go to Settings -...
Cross-Site Scripting (XSS)
DOMPurify is vulnerable to cross-site scripting XSS. It bypasses the XSS check because of innerHTML mutation behavior for an SVG element or a MATH element in Chrome and Safari, causing the tags to be rewritten to by the browser and then to be rewritten to after assigning it to innerHTML. It allow...
DOMPurify Cross-Site Scripting Vulnerability
DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A cross-site scripting vulnerability exists in versions of DOMPurify prior to 2.0.1, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker...
CVE-2019-16728
DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS mXSS for an SVG element or a MATH element, as demonstrated by Chrome and Safari...
