WS-2019-0587

@ionic/core versions 4.0.x before 4.0.3, 4.1.x before 4.1.3, 4.2.x before 4.2.1, 4.3.x before 4.3.1 has cross-site scripting vulnerability when using unsafe innerHTML function without sanitizing input...

@ccrpc/webmapgl (>=0.7.0, <=0.9.0), @dev-engage/engage-ionic (>=0.3.7, <=0.5.1) +8 more potentially affected by unknown CVE via @ionic/core (>=4.0.0-rc.2, <=4.0.2)

@ionic/core NPM version =4.0.0-rc.2, =0.7.0, =0.3.7, =4.0.0-rc.2, =0.0.3-0, =0.5.68, =0.1.1, =0.0.1, =0.0.11 Source cves: unknown CVE Source advisory: MEND:WS-2019-0587...

@dev-engage/engage-ionic (>=0.6.0, <=0.6.6), @ionic/angular (>=4.1.0-dev.201902122208.39fbc32, <=4.1.3-dev.201903261530.1ecfcd1) +2 more potentially affected by unknown CVE via @ionic/core (>=4.1.0-dev.201902122208.39fbc32, <=4.1.3-dev.201903261530.1ecfcd1)

@ionic/core NPM version =4.1.0-dev.201902122208.39fbc32, =0.6.0, =4.1.0-dev.201902122208.39fbc32, =4.1.3-dev.201903261530.1ecfcd1 - @ionic/pwa-elements 1.0.2 - dos-wc-library 0.6.1 Source cves: unknown CVE Source advisory: MEND:WS-2019-0587...

@ccrpc/tip (>=0.1.0, <=0.3.2), @ccrpc/webmapgl (>=0.10.0, <=0.13.0) +6 more potentially affected by unknown CVE via @ionic/core (>=4.2.0-dev.201903262032.a8a48a4, <=4.2.1-dev.201904231454.26ca72c)

@ionic/core NPM version =4.2.0-dev.201903262032.a8a48a4, =0.1.0, =0.10.0, =4.2.0, =4.2.0, =4.2.0-dev.201903262032.a8a48a4, =2.2.3-alpha.0, =0.9.0, =0.12.2 - dos-wc-library 0.7.10 Source cves: unknown CVE Source advisory: MEND:WS-2019-0587...

@ionic/angular (>=4.3.0-dev.201904161617.4474974, <=4.3.1-dev.201904231448.eb3cbe4), dos-wc-library (>=0.7.7, <=0.7.21) potentially affected by unknown CVE via @ionic/core (>=4.3.0-dev.201904161617.4474974, <=4.3.1-dev.201904231448.eb3cbe4)

@ionic/core NPM version =4.3.0-dev.201904161617.4474974, =4.3.0-dev.201904161617.4474974, =0.7.7, =0.7.21 Source cves: unknown CVE Source advisory: MEND:WS-2019-0587...

Cross-Site Scripting in @ionic/core

Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the components: ...

@ionic/angular (>=4.3.0, <=4.3.1-dev.201904231448.eb3cbe4), dos-wc-library (>=0.7.7, <=0.7.21) potentially affected by unknown CVE via @ionic/core (>=4.3.0, <=4.3.1-dev.201904231448.eb3cbe4)

@ionic/core NPM version =4.3.0, =4.3.0, =0.7.7, =0.7.21 Source cves: unknown CVE Source advisory: GHSA-R3XC-47QG-H929...

@ccrpc/webmapgl (>=0.5.0, <=0.9.0), @cuuats/webmapgl (>=0.1.0, <=0.5.0) +28 more potentially affected by unknown CVE via @ionic/core (>=4.0.0-alpha.1, <=4.0.2)

@ionic/core NPM version =4.0.0-alpha.1, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =4.0.0-alpha.1, =1.0.0, =0.0.2, =0.0.1, =0.0.37 - @zencomputersystems/eleave-user 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-R3XC-47QG-H929...

@ccrpc/webmapgl (>=0.5.0, <=0.9.0), @cuuats/webmapgl (>=0.1.0, <=0.5.0) +28 more potentially affected by unknown CVE via @ionic/core (>=4.0.0-alpha.1, <=4.0.2)

@ionic/core NPM version =4.0.0-alpha.1, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =4.0.0-alpha.1, =1.0.0, =0.0.2, =0.0.1, =0.0.37 - @zencomputersystems/eleave-user 0.0.1 and more Source cves: unknown CVE Source advisory: GHSA-R3XC-47QG-H929...

@dev-engage/engage-ionic (>=0.6.0, <=0.6.6), @ionic/angular (>=4.1.0, <=4.1.3-dev.201903261530.1ecfcd1) +2 more potentially affected by unknown CVE via @ionic/core (>=4.1.0, <=4.1.3-dev.201903261530.1ecfcd1)

@ionic/core NPM version =4.1.0, =0.6.0, =4.1.0, =4.1.3-dev.201903261530.1ecfcd1 - @ionic/pwa-elements 1.0.2 - dos-wc-library 0.6.1 Source cves: unknown CVE Source advisory: OSV:GHSA-R3XC-47QG-H929...

@dev-engage/engage-ionic (>=0.6.0, <=0.6.6), @ionic/angular (>=4.1.0, <=4.1.3-dev.201903261530.1ecfcd1) +2 more potentially affected by unknown CVE via @ionic/core (>=4.1.0, <=4.1.3-dev.201903261530.1ecfcd1)

@ionic/core NPM version =4.1.0, =0.6.0, =4.1.0, =4.1.3-dev.201903261530.1ecfcd1 - @ionic/pwa-elements 1.0.2 - dos-wc-library 0.6.1 Source cves: unknown CVE Source advisory: GHSA-R3XC-47QG-H929...

@ccrpc/tip (>=0.1.0, <=0.3.2), @ccrpc/webmapgl (>=0.10.0, <=0.13.0) +6 more potentially affected by unknown CVE via @ionic/core (>=4.2.0, <=4.2.1-dev.201904231454.26ca72c)

@ionic/core NPM version =4.2.0, =0.1.0, =0.10.0, =4.2.0, =4.2.0, =4.2.0, =2.2.3-alpha.0, =0.9.0, =0.12.2 - dos-wc-library 0.7.10 Source cves: unknown CVE Source advisory: OSV:GHSA-R3XC-47QG-H929...

@ccrpc/tip (>=0.1.0, <=0.3.2), @ccrpc/webmapgl (>=0.10.0, <=0.13.0) +6 more potentially affected by unknown CVE via @ionic/core (>=4.2.0, <=4.2.1-dev.201904231454.26ca72c)

@ionic/core NPM version =4.2.0, =0.1.0, =0.10.0, =4.2.0, =4.2.0, =4.2.0, =2.2.3-alpha.0, =0.9.0, =0.12.2 - dos-wc-library 0.7.10 Source cves: unknown CVE Source advisory: GHSA-R3XC-47QG-H929...

@ionic/angular (>=4.3.0, <=4.3.1-dev.201904231448.eb3cbe4), dos-wc-library (>=0.7.7, <=0.7.21) potentially affected by unknown CVE via @ionic/core (>=4.3.0, <=4.3.1-dev.201904231448.eb3cbe4)

@ionic/core NPM version =4.3.0, =4.3.0, =0.7.7, =0.7.21 Source cves: unknown CVE Source advisory: OSV:GHSA-R3XC-47QG-H929...

GHSA-R3XC-47QG-H929 Cross-Site Scripting in @ionic/core

Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the components: ...

PT-2020-21477

Name of the Vulnerable Software and Affected Versions @ionic/core versions prior to 4.0.3 @ionic/core versions prior to 4.1.3 @ionic/core versions prior to 4.2.1 @ionic/core versions prior to 4.3.1 Description The issue affects @ionic/core, where the package uses the unsafe innerHTML function...

Cross-site Scripting (XSS)

@ionic/core is vulnerable to cross-site scripting XSS. The attack exists because the unsafe innerHTML function is rendered directly on the alert-message string with the following components: .message,.placeholder, .loadingText, .pullingText, .refershingText...

Cross-Site Scripting

Overview Versions of @ionic/core prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the...