Critical Adobe Flaws Allow Attackers to Run JavaScript in Browsers

UPDATE Adobe has released fixes addressing five critical flaws in its popular Experience Manager content-management solution for building websites, mobile apps and forms. The cross-site scripting XSS flaws could allow attackers to execute JavaScript in targets’ browsers. Including Adobe Experienc...

PT-2020-5065

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.5.0 and earlier Adobe Experience Manager versions 6.4.8.1 and earlier Adobe Experience Manager versions 6.3.3.8 and earlier Adobe Experience Manager versions 6.2 SP1-CFP20 and earlier Description The issue...

PT-2020-5101

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.5.0 and earlier Adobe Experience Manager versions 6.4.8.1 and earlier Adobe Experience Manager versions 6.3.3.8 and earlier Adobe Experience Manager versions 6.2 SP1-CFP20 and earlier Description The issue...

APSB20-56 Security update available for Adobe Experience Manager

Adobe has released updates for Adobe Experience Manager AEM and the AEM Forms add-on package. These updates resolve vulnerabilities rated Critical and Important. Successful exploitation of these vulnerabilities could result in arbitrary JavaScript execution in the browser...

Brave Software: Arbitrary file download due to bad handling of Redirects in WebTorrent

Summary: Previously I reported 963155 how an attacker can trick user into downloading malicious files using ".save torrent" feature, In this report I am going to reproduce the same behavior but by abusing a different feature. Description While I was testing webtorrent on brave I noticed that...

GHSA-25V4-MCX4-HH35 Cross-Site Scripting in atlasboard-atlassian-package

All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers being able t...

Cross-Site Scripting in takeapeek

All versions of takeapeek are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider usin...

GHSA-V9WP-8R97-V6XG Cross-Site Scripting in jquery.json-viewer

Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting XSS. The package insufficiently sanitizes user input when creating links, and concatenates the user input in an tag. This allows attackers to create malicious links with JSON payloads such as: "foo":...

PT-2020-21514

Name of the Vulnerable Software and Affected Versions jquery.json-viewer versions prior to 1.3.0 Description The issue arises from insufficient sanitization of user input when creating links, allowing attackers to create malicious links with JSON payloads. This can lead to arbitrary JavaScript...

PT-2020-21477

Name of the Vulnerable Software and Affected Versions @ionic/core versions prior to 4.0.3 @ionic/core versions prior to 4.1.3 @ionic/core versions prior to 4.2.1 @ionic/core versions prior to 4.3.1 Description The issue affects @ionic/core, where the package uses the unsafe innerHTML function...

PT-2020-21246

Name of the Vulnerable Software and Affected Versions @toast-ui/editor versions prior to 2.2.0 Description The issue allows attackers to execute arbitrary JavaScript on a victim's browser due to multiple bypasses of the package's built-in XSS sanitization, which may lead to Cross-Site Scripting...

PT-2020-21372

Name of the Vulnerable Software and Affected Versions mavon-editor versions all Description The issue concerns a failure to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim's browser, thus enabling Cross-Site Scripting attacks. Recommendations For all version...

PT-2020-21439

Name of the Vulnerable Software and Affected Versions hexo-admin versions all versions Description The issue concerns a failure to sanitize rendered markdown, which allows attackers to execute arbitrary JavaScript in a victim's browser if they can create new posts. This is a Cross-Site Scripting...

CVE-2020-13972: Improper Neutralization of Input During Web Page Generation

Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951...

GHSA-G7MW-5CQ6-FV82 Cross-Site Scripting in wangeditor

All versions of wangeditor are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers. Recommendation No fix is currently available. Consider using an alternative module until a fix is made...

GHSA-3QH4-R86R-GRVM Arbitrary JavaScript Execution in typed-function

Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code. Recommendation Upgrade to version 0.10.6 or later...

Arbitrary JavaScript Execution in typed-function

Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code. Recommendation Upgrade to version 0.10.6 or later...

GHSA-49RV-G7W5-M8XX Cross-Site Scripting in @novnc/novnc

Versions of @novnc/novnc prior to 0.6.2 are vulnerable to Cross-Site Scripting XSS. The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects...

CVE-2020-19007

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser...

PT-2020-21318

Name of the Vulnerable Software and Affected Versions highcharts versions prior to 7.2.2 highcharts versions prior to 8.1.1 Description The issue arises from the failure to sanitize href values and the lack of restriction on URL schemes, allowing attackers to execute arbitrary JavaScript in a...