295 matches found
CVE-2022-3127 Cross-site Scripting (XSS) - Stored in jgraph/drawio
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 20.2.8...
CVE-2022-3127
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 20.2.8...
XSS with CSP bypass on WEB instances
📝 Description Drawio WEB instancesn allows https://storage.googleapis.com in CSP script-src, abusing the XSS found in this report, it is possible to bypass the CSP and leak private diagram content. 🕵️♂️ Proof of Concept On the web application side, the javascript execution is protected by the...
PT-2022-20658 · Unknown · Jgraph/Drawio
Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 20.2.8 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs in the GitHub repository jgraph/drawio. Recommendations: For versions prior to 20.2.8, update to version 20.2.8 or lat...
CVE-2022-3127: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 20.2.8...
JGraph draw.io 跨站脚本漏洞
JGraph draw.io is a configurable chart/whiteboard visualization application for JGraph. A cross-site scripting vulnerability exists in JGraph draw.io prior to version 20.2.8...
PT-2022-7694 · Drawio +1 · Drawio +1
Name of the Vulnerable Software and Affected Versions: drawio versions prior to 20.3.0 Description: The issue is related to the incorrect neutralization of special elements used in an OS command, which can allow a remote attacker to execute arbitrary commands. Recommendations: For versions prior ...
CVE-2022-3065
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...
CVE-2022-3065
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...
CVE-2022-3065
CVE-2022-3065 corresponds to an Improper Access Control in the GitHub repository jgraph/drawio, affecting versions prior to 20.2.8. Multiple connected sources describe the issue as arising from inadequate access control tied to the proxy URL parameter, with no rate‑limiting, which could enable ab...
CVE-2022-3065
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...
CVE-2022-3065 Improper Access Control in jgraph/drawio
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...
CVE-2022-3065 Improper Access Control in jgraph/drawio
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...
CVE-2022-3065: Improper Access Control
Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...
PT-2022-20226 · Unknown · Jgraph/Drawio
Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 20.2.8 Description: The issue is related to improper access control in the GitHub repository jgraph/drawio. Recommendations: For versions prior to 20.2.8, update to version 20.2.8 or later to resolve the issue...
The vulnerability of the url.openConnection() method in Embed2 software, a service for creating drawio diagrams, allows a attacker to perform an SSRF attack.
The vulnerability of the url.openConnection method in Embed2 software, which is used for creating drawio diagrams, is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack by sending a specially crafted HTTP...
Forward credential header to attacker host
Description Some Admins set the "Authorization" header with the help of a reverse proxy to restrict initial access to the Drawio application server. In this kind of setup, the "Authorization" header should always be sent to the reverse proxy, and the reverse proxy will forward it to Drawio But Th...
CVE-2022-2015
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 19.0.2...