CVE-2020-13666

Removed by vendor...

CVE-2020-13666

Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6...

GitHub Security Lab: Java: JSONP Injection

This bug was reported directly to GitHub Security Lab...

Cross-Site Scripting (XSS)

Overview Affected versions of angular are vulnerable to JSONP Callback Attack. JSONP JSON with padding is a method used to request data from a server residing in a different domain than the client. Any url could perform JSONP requests, allowing full access to the browser and the JavaScript contex...

Debian DLA-2458-1 : drupal7 security update

Two vulnerabilities were discovered in Drupal, a fully-featured content management framework. CVE-2020-13666 The Drupal AJAX API did not disable JSONP by default, which could lead to cross-site scripting. For setups that relied on Drupal's AJAX API for JSONP requests, either JSONP will need to be...

FreeBSD : drupal -- Multiple Vulnerabilities (95d9d986-1078-11eb-ab74-4c72b94353b5)

Drupal Security Team reports : The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrin...

Cross-Site Scripting (XSS)

mapfish-print is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via JSONP...

CVE-2020-15231

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

CVE-2020-15231

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

Cross site scripting

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

CVE-2020-15231

CVE-2020-15231 affects mapfish-print prior to version 3.24. A JSONP misuse in mapfish-print allows Cross-site Scripting, enabling an attacker to inject and execute arbitrary JavaScript in a user’s browser via JSONP. Remediation per advisories is to upgrade to version 3.24 or later. The connected ...

CVE-2020-15231 Cross-site scripting attack in mapfish-print

In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting...

drupal -- Multiple Vulnerabilities

Drupal Security Team reports: The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting...

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007

The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting...

PT-2020-6401 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions prior to 7.73 Drupal Core 8.8.x versions prior to 8.8.10 Drupal Core 8.9.x versions prior to 8.9.6 Drupal Core 9.0.x versions prior to 9.0.6 Description: The issue is related to a cross-site scripting vulnerability in...

@csltech/strong-nginx-controller (>=1.0.2, <=1.0.3), @csltech/strong-pm (>=7.0.0, <=7.0.2) +56 more potentially affected by CVE-2016-1000226 via swagger-ui (>=2.0.2, <=2.1.8-M1)

swagger-ui NPM version =2.0.2, =1.0.2, =7.0.0, =3.0.1, =2.0.0, =1.0.1, =1.0.1, =2.8.29, =1.0.1, =5.0.232, =0.0.1, =0.4.1, =1.0.1, =0.0.1, =0.0.27, =0.1.9 and more Source cves: CVE-2016-1000226 Source advisory: OSV:GHSA-7F59-X49P-V8MQ...

Cross-Site Scripting (XSS)

print-lib/print-servlet is vulnerable to cross-site scripting. A remote attacker is able to inject and execute Javascript in a user's browser via JSONP...

GHSA-W534-Q4XF-H5V2 XSS in Mapfish Print relating to JSONP support

Impact A user can use the JSONP support to do a Cross-site scripting. Patches Use version = 3.24 Workarounds No References https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e https://cwe.mitre.org/data/definitions/79.html For more information If you...

XSS in Mapfish Print relating to JSONP support

Impact A user can use the JSONP support to do a Cross-site scripting. Patches Use version = 3.24 Workarounds No References https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e https://cwe.mitre.org/data/definitions/79.html For more information If you...

JSONBee - A Ready To Use JSONP Endpoints/Payloads To Help Bypass Content Security Policy Of Different Websites

A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...