PT-2020-21225

Name of the Vulnerable Software and Affected Versions @berslucas/liljs versions prior to 1.0.2 Description The issue concerns the use of the unsafe innerHTML function without input sanitization, potentially allowing attackers to execute arbitrary JavaScript on a victim's browser, thus facilitatin...

PT-2020-21477

Name of the Vulnerable Software and Affected Versions @ionic/core versions prior to 4.0.3 @ionic/core versions prior to 4.1.3 @ionic/core versions prior to 4.2.1 @ionic/core versions prior to 4.3.1 Description The issue affects @ionic/core, where the package uses the unsafe innerHTML function...

PT-2020-21270

Name of the Vulnerable Software and Affected Versions htmr versions prior to 0.8.7 Description The issue arises from the use of innerHTML to unescape HTML entities, potentially leading to DOM-based XSS attacks through HTML-encoded XSS payloads. This could allow an attacker to execute arbitrary...

PT-2020-21276

Name of the Vulnerable Software and Affected Versions jquery-mobile versions affected versions not specified Description The issue concerns a Cross-Site Scripting problem. It arises because the package checks the location.hash for content and, upon finding a URL, performs an XmlHttpRequest to the...

Cross-site Scripting (XSS)

qunit is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not escape the value of details.source in innerHTML of reporter/html.js...

Cross-site Scripting (XSS)

Overview lazysizes is a fast jank-free, SEO-friendly and self-initializing lazyloader for images including responsive images picture/srcset, iframes, scripts/widgets and much more. It also prioritizes resources by differentiating between crucial in view and near view elements to make perceived...

Cross-Site Scripting (XSS)

bleach is vulnerable to cross-site scripting XSS. Invocation of bleach.clean method with a scripting parameter set to FALSE and a raw tags such as title, textarea, script, style, noembed, noframes, iframe, xmp allows BleachHTMLParser to process user-contributed content using innerHTML property,...

Mozilla: CSS sanitization does not escape HTML tags

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

Mozilla: CSS sanitization does not escape HTML tags

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

Mozilla: CSS sanitization does not escape HTML tags

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

Mozilla: CSS sanitization does not escape HTML tags

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

Mozilla: CSS sanitization does not escape HTML tags

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

Mozilla: CSS sanitization does not escape HTML tags

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

DEBIAN-CVE-2019-17022

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

UBUNTU-CVE-2019-17022

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

CVE-2019-17022

When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer does not escape characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the...

CVE-2019-17022

When pasting a style tag from the clipboard into a rich text editor, the CSS sanitizer does not escape and characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently...

CVE-2019-17022: Improper Neutralization of Input During Web Page Generation

When pasting a tag from the clipboard into a rich text editor, the CSS sanitizer does not escape characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however, if a webpage subsequently copies the...

Cross-Site Scripting (XSS)

react-autolinker-wrapper is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser as the library does not validate user input and directly render the user provided data when calling the invokeLink method, allowing the conversion o...

PT-2019-4868

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 68.4 Firefox versions prior to 72 Description The issue arises when a tag is pasted from the clipboard into a rich text editor, and the CSS sanitizer fails to escape characters. Although this does not directly...