Code injection

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

CVE-2018-20801

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

CVE-2018-20801

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

CVE-2018-20801

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS...

CVE-2018-20801

Highcharts JS (before 6.1.0) has a Regular Expression Denial of Service (ReDoS) flaw in SvgRenderer.js due to backtracking regex usage. This could allow an attacker to disrupt the SVGRenderer component by processing crafted input. Remediation: upgrade to Highcharts 6.1.0 or newer. Affected CVE: C...

New Relic: Stored XSS in notes (charts) because of insecure chart data JSON generation

Hey team, I have discovered vulnerability of chart data JSON generation endpoint when the chart is displayed inside a note allowing attacker to inject arbitrary fields into it and leading to stored XSS. The impact is higher than usual here because the payload remains after publishing a note so th...

Nagios XI Magpie_debug.php Root Remote Code Execution

This module exploits two vulnerabilities in Nagios XI use exploit/linux/http/nagios/ximagpiedebug msf undefinedximagpiedebug show actions ...actions... msf undefinedximagpiedebug set ACTION msf undefinedximagpiedebug show options ...show and set options... msf undefinedximagpiedebug run This modu...

forum.highcharts.com XSS vulnerability

Open Bug Bounty ID: OBB-446580 Description| Value ---|--- Affected Website:| forum.highcharts.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

highcharts.com XSS vulnerability

Open Bug Bounty ID: OBB-238908 Description| Value ---|--- Affected Website:| highcharts.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Sucuri: Usage of HTTP for exporting graph data as images

Whenever a user of waf.sucuri.net exports his reports graph data as a png, an unencrypted request is sent over to export.highcharts.com. This enables a mitm-able attacker to sniff and|or replace exported image. Also, the whole practice of offloading potentially private user data to an unrelated...