GHSA-5G6J-8HV4-VFGJ Cross-Site Scripting in node-red

Versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...

@homenet/core (>=4.0.0-beta.15, <=4.0.0-beta.42), @jatahworx/bhive-core (>=1.0.76, <=3.3.1) +29 more potentially affected by unknown CVE via node-red (>=0.9.1, <=0.18.3)

node-red NPM version =0.9.1, =4.0.0-beta.15, =1.0.76, =2.5.0, =0.0.1, =0.0.4, =0.0.0, =0.0.1, =0.1.2, =0.1.0, =1.0.0, =0.9.0, =1.1.0, =1.0.0, =1.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5G6J-8HV4-VFGJ...

PT-2020-21061

Name of the Vulnerable Software and Affected Versions node-red versions prior to 0.18.6 Description The issue is related to Cross-Site Scripting XSS due to the failure to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser...

homestar-samsung-smart-tv (>=0.0.1, <=0.0.19), node-red-contrib-samsungtv (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via samsung-remote (1.2.5)

samsung-remote NPM version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on samsung-remote and may be impacted: - homestar-samsung-smart-tv =0.0.1, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-XHJX-MFR6-9RR4...

@homenet/core (>=4.0.0-beta.15, <=4.0.0-beta.42), @jatahworx/bhive-core (>=1.0.76, <=6.2.1) +42 more potentially affected by CVE-2019-15607 via node-red (>=0.9.1, <=0.20.7)

node-red NPM version =0.9.1, =4.0.0-beta.15, =1.0.76, =1.0.0, =2.5.0, =0.0.1, =0.0.4, =0.0.0, =0.0.1, =0.0.0, =0.1.2, =0.1.0, =1.0.0, =2.1.0 - matsample 1.0.0 and more Source cves: CVE-2019-15607 Source advisory: OSV:GHSA-8W65-XJC5-9W79...

GHSA-8W65-XJC5-9W79 Cross-Site Scripting in node-red

Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...

Cross-Site Scripting in node-red

Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

Cross site scripting

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

CVE-2019-15607 is a stored XSS vulnerability in the node-red npm package (versions

PT-2020-9729

Name of the Vulnerable Software and Affected Versions node-red versions prior to 0.20.8 Description A stored XSS issue is present in the node-red npm package, a visual tool for wiring the Internet of Things. This allows attackers to steal session cookies and deface web applications by executing...

CVE-2019-15607: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

Cross-Site Scripting

Overview Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later. References - HackerOne...

Cross-Site Scripting (XSS)

node-red is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the name field when renaming a flow in the Workspace dialog...

Cross-site Scripting in node-red-dashboard

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

GHSA-XG59-M7WX-853Q Cross-site Scripting in node-red-dashboard

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)

node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: OSV:GHSA-XG59-M7WX-853Q...