CVE-2021-29489 Options structure open to XSS if passed unfiltered

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

CVE-2021-29489

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

@51yzone/chart (>=1.0.0, <=1.0.4), @actonate/mirkwood-rx (0.10.9) +691 more potentially affected by CVE-2021-29489 via highcharts (>=4.2.0, <=8.2.2)

highcharts NPM version =4.2.0, =1.0.0, =0.2.2, =0.0.3, =0.2.1, =2.1.4, =1.16.6, =3.6.0, =0.0.1, =0.1.0, =1.22.1-3, =0.0.1, =0.1.0, =0.75.0, =1.77.4 and more Source cves: CVE-2021-29489 Source advisory: MEND:CVE-2021-29489...

CVE-2021-29489

Highcharts JS (charting library) versions 8 and earlier are vulnerable to cross-site scripting due to inadequate filtering of the chart options structure for XSS vectors. The vulnerability can allow execution of untrusted script in the end user’s browser if the configuration contains malicious in...

CVE-2021-29489: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The...

PT-2021-18250

Name of the Vulnerable Software and Affected Versions: Highcharts versions 8 and earlier Description: Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impac...

Highcharts JS Cross-Site Scripting Vulnerabilities

Highcharts JS is an SVG-based JavaScript charting framework. DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A cross-site scripting vulnerability exists in Highcharts JS, which can be exploited by an attacker to execute code in a browser...

Information Disclosure

highcharts-export-server is vulnerable to information disclosure. If the export server is accessible via internet, it allows reading of internal HTTP resources and outputting files served by other services on the internal network in which the export server is hosted...

Exposure of internal HTTP resources

Overview In highcharts-export-server before version 2.1.0 there is a vulnerability that allows exposure of internal HTTP resources. Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export...

Vulnerability allowing for reading internal HTTP resources

Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources. The impa...

GHSA-HFWX-C7Q6-G54C Vulnerability allowing for reading internal HTTP resources

Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources. The impa...

Prototype Pollution

Amendment This was deemed not a vulnerability. Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. The function recursively merges the...

Cross-Site Scripting (XSS)

highcharts is vulnerable to cross-site scripting XSS. Lack of sanitization of href values and no URL schemes restriction allows an attacker to inject malicious javascript and get executed when a user visits the page...

GHSA-GR4J-R575-G665 Cross-Site Scripting in highcharts

Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link...

Cross-Site Scripting in highcharts

Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link...

@gooddata/react-components (>=7.1.0-alpha, <=7.9.2-beta.20), @gooddata/sdk-ui (8.0.0-alpha.14) +38 more potentially affected by unknown CVE via highcharts (>=7.0.0, <=7.2.1)

highcharts NPM version =7.0.0, =7.1.0-alpha, =8.0.0-alpha-afi-afi-one-4619-turn-off-lines-option-2020-09-03T22-09-02-779Z, =0.0.111, =1.1.34, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =7.3.0, =4.1.12, =6.0.0, =0.1.1, =0.1.2 - fe-chart-lib 1.0.0 and more Source cves: unknown CVE Source advisory:...

@gooddata/react-components (>=7.1.0-alpha, <=7.9.2-beta.20), @gooddata/sdk-ui (8.0.0-alpha.14) +38 more potentially affected by unknown CVE via highcharts (>=7.0.0, <=7.2.1)

highcharts NPM version =7.0.0, =7.1.0-alpha, =8.0.0-alpha-afi-afi-one-4619-turn-off-lines-option-2020-09-03T22-09-02-779Z, =0.0.111, =1.1.34, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =7.3.0, =4.1.12, =6.0.0, =0.1.1, =0.1.2 - fe-chart-lib 1.0.0 and more Source cves: unknown CVE Source advisory:...

@aqsi/ui (>=3.22.0-rc.0, <=4.15.1), @ausbom/charts (>=0.1.0, <=0.1.2) +6 more potentially affected by unknown CVE via highcharts (>=8.0.0, <=8.1.0)

highcharts NPM version =8.0.0, =3.22.0-rc.0, =0.1.0, =0.0.0, =1.3.0, =7.0.0-alpha1, =16.8.1, =1.2.8, =1.0.6, =1.0.7 Source cves: unknown CVE Source advisory: OSV:GHSA-GR4J-R575-G665...

@aqsi/ui (>=3.22.0-rc.0, <=4.15.1), @ausbom/charts (>=0.1.0, <=0.1.2) +6 more potentially affected by unknown CVE via highcharts (>=8.0.0, <=8.1.0)

highcharts NPM version =8.0.0, =3.22.0-rc.0, =0.1.0, =0.0.0, =1.3.0, =7.0.0-alpha1, =16.8.1, =1.2.8, =1.0.6, =1.0.7 Source cves: unknown CVE Source advisory: GHSA-GR4J-R575-G665...

PT-2020-21318

Name of the Vulnerable Software and Affected Versions highcharts versions prior to 7.2.2 highcharts versions prior to 8.1.1 Description The issue arises from the failure to sanitize href values and the lack of restriction on URL schemes, allowing attackers to execute arbitrary JavaScript in a...