CVE-2020-13666

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

CVE-2020-13666

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

UBUNTU-CVE-2020-13666

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

Cross site scripting

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

CVE-2020-13666

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

CVE-2020-13666

Vulnerability: CVE-2020-13666 – Cross-site scripting in Drupal Core via JSONP in the AJAX API. Affected products (examples): Drupal Core 7.x before 7.73; 8.8.x before 8.8.10; 8.9.x before 8.9.6; 9.0.x before 9.0.6. Root cause: JSONP is not disabled by default in the Drupal AJAX API, enabling XSS ...

CVE-2020-13666

Removed by vendor...

GitHub Security Lab: Java: JSONP Injection

This bug was reported directly to GitHub Security Lab...

Cross-Site Scripting (XSS)

Overview Affected versions of angular are vulnerable to JSONP Callback Attack. JSONP JSON with padding is a method used to request data from a server residing in a different domain than the client. Any url could perform JSONP requests, allowing full access to the browser and the JavaScript contex...

Debian DLA-2458-1 : drupal7 security update

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. CVE-2020-13666 The Drupal AJAX API did not disable JSONP by default, which could lead to cross-site scripting. For setups that relied on Drupal's AJAX API for JSONP requests, either JSONP will need to be...

FreeBSD : drupal -- Multiple Vulnerabilities (95d9d986-1078-11eb-ab74-4c72b94353b5)

Drupal Security Team reports : The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrin...

Cross-Site Scripting (XSS)

mapfish-print is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via JSONP...

CVE-2020-15231

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

CVE-2020-15231

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

Cross site scripting

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

CVE-2020-15231

CVE-2020-15231 affects mapfish-print prior to version 3.24. A JSONP misuse in mapfish-print allows Cross-site Scripting, enabling an attacker to inject and execute arbitrary JavaScript in a user’s browser via JSONP. Remediation per advisories is to upgrade to version 3.24 or later. The connected ...

CVE-2020-15231 Cross-site scripting attack in mapfish-print

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007

The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting...

drupal -- Multiple Vulnerabilities

Drupal Security Team reports: The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting...

PT-2020-6401 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions prior to 7.73 Drupal Core 8.8.x versions prior to 8.8.10 Drupal Core 8.9.x versions prior to 8.9.6 Drupal Core 9.0.x versions prior to 9.0.6 Description: The issue is related to a cross-site scripting vulnerability in...