129 matches found
i-form-base (1.0.0) potentially affected by CVE-2024-47075 via layui (2.7.6)
layui NPM version 2.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on layui and may be impacted: - i-form-base 1.0.0 Source cves: CVE-2024-47075 Source advisory: OSV:GHSA-J827-6RGF-9629...
Layui has DOM Clobbering gadgets that leads to Cross-site Scripting
Summary A DOM Clobbering vulnerability has been discovered in layui that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., img tags with unsanitized name attributes are present. It's worth noting that we’ve identifed similar issues in other popular...
GHSA-J827-6RGF-9629 Layui has DOM Clobbering gadgets that leads to Cross-site Scripting
Summary A DOM Clobbering vulnerability has been discovered in layui that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., img tags with unsanitized name attributes are present. It's worth noting that we’ve identifed similar issues in other popular...
i-form-base (1.0.0) potentially affected by CVE-2024-47075 via layui (2.7.6)
layui NPM version 2.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on layui and may be impacted: - i-form-base 1.0.0 Source cves: CVE-2024-47075 Source advisory: GHSA-J827-6RGF-9629...
CVE-2024-47075 DOM Clobbering gadgets found in layui that lead to Cross-site Scripting
LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., img tags with unsanitized name attributes are present. Version 2.9.17...
i-form-base (1.0.0), vporimprot (1.0.0) potentially affected by CVE-2024-47075 via layui (>=0.0.1, <=2.7.6)
layui NPM version =0.0.1, =2.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on layui and may be impacted: - i-form-base 1.0.0 - vporimprot 1.0.0 Source cves: CVE-2024-47075 Source advisory: MEND:CVE-2024-47075...
CVE-2024-47075
CVE-2024-47075 concerns LayUI, a native minimalist Web UI library. The vulnerability is a DOM Clobbering flaw in versions prior to 2.9.17 that can lead to Cross‑site Scripting (XSS) on pages containing attacker‑controlled HTML elements (e.g., img tags with unsanitized name attributes). The issue ...
CVE-2024-47075 DOM Clobbering gadgets found in layui that lead to Cross-site Scripting
LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., img tags with unsanitized name attributes are present. Version 2.9.17...
CVE-2024-47075
LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., "img" tags with unsanitized "name" attributes are present. Version 2.9.1...
CVE-2024-47075 DOM Clobbering gadgets found in layui that lead to Cross-site Scripting
LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., img tags with unsanitized name attributes are present. Version 2.9.17...
PT-2024-32392 · Layui · Layui
Name of the Vulnerable Software and Affected Versions: LayUI versions prior to 2.9.17 Description: The issue is related to a DOM Clobbering vulnerability that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements, such as img tags with unsanitized name...
LayUI security vulnerabilities
Layui is a set of Web UI component libraries that follow the original development model of Layui open source. A security vulnerability exists in LayUI prior to version 2.9.17, which stems from pages containing uncleaned tags...
CVE-2024-47075: Improper Neutralization of Input During Web Page Generation
LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting XSS on web pages where attacker-controlled HTML elements e.g., img tags with unsanitized name attributes are present. Version 2.9.17...
vaeThink Security Vulnerabilities
vaeThink is a software application. Based on ThinkPHP5 and Layui development, while keeping the core concepts of rapid development and the road to simplicity unchanged, it provides basic development and encapsulation of the functions necessary for general projects, helping users to quickly comple...
springboot-manager Security Vulnerability
springboot-manager is a backend management system based on SpringBoot + Thymeleaf + Layui + Apache Shiro + Redis + Mybatis Plus by Chinese liwenbin individual developer. A security vulnerability exists in springboot-manager v1.6, which originates from an easy cross-site scripting attack via...
GHSA-RCVR-8WHX-3M5P Layui cross-site scripting (XSS) vulnerability
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
Layui cross-site scripting (XSS) vulnerability
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
CVE-2023-50550
layui up to v2.74 was discovered to contain a cross-site scripting XSS vulnerability via the data-content parameter...
