295 matches found
Desktop APP RCE via saveDraft IPC
🔒️ Requirements The user must load a malicious project. 📝 Description In version 20.3.3 commit 5383c20e947fd772668316e407edc5d5db4850db, the shell=true option is added to a spawn execution. This is really dangerous has it allows a malicious user to execute commands even from attributes. Example: j...
CVE-2023-3026
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 21.2.8...
CVE-2023-3026
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 21.2.8...
Cross site scripting
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 21.2.8...
CVE-2023-3026: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 21.2.8...
CVE-2023-3026
The CVE-2023-3026 entry corresponds to a Stored Cross-Site Scripting (XSS) vulnerability in jgraph/drawio, affecting versions prior to 21.2.8. The issue is caused by improper handling of user input stored in the application, enabling XSS payloads to execute when loaded. Public documentation provi...
PT-2023-22610 · Jgraph · Jgraph/Drawio
Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 21.2.8 Description: The issue is related to Cross-site Scripting XSS - Stored. This type of attack occurs when an application stores user input that contains malicious code, which is then executed by the...
CVE-2023-3026
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 21.2.8...
CVE-2023-3026 Cross-site Scripting (XSS) - Stored in jgraph/drawio
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 21.2.8...
CVE-2023-3026 Cross-site Scripting (XSS) - Stored in jgraph/drawio
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 21.2.8...
CVE-2023-3026 Cross-site Scripting (XSS) - Stored in jgraph/drawio
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 21.2.8...
CVE-2022-3873
Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...
UBUNTU-CVE-2022-3873
Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...
CVE-2022-3873
Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...
CVE-2022-3873 Cross-site Scripting (XSS) - DOM in jgraph/drawio
Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...
CVE-2022-3873 Cross-site Scripting (XSS) - DOM in jgraph/drawio
Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...
CVE-2022-3873
Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...
PT-2022-24545 · Drawio · Drawio
Name of the Vulnerable Software and Affected Versions: drawio versions prior to 20.5.2 Description: The issue is related to Cross-site Scripting XSS - DOM, which occurs when an application includes user input in its output without proper validation or escaping. This allows an attacker to inject...