WS-2019-0590

In node-red in versions 0.16.2 to 0.18.5 is vulnerable to stored XSS...

@onshape/ng-i18next (0.3.12), amdblah-hbs-helpers (>=0.0.1, <=0.2.1) +21 more potentially affected by CVE-2017-16008 via i18next (>=1.5.0, <=1.10.2)

i18next NPM version =1.5.0, =0.0.1, =0.0.3, =0.4.3, =0.3.1, =0.10.11, =0.1.10, =1.0.2, =0.3.3, =0.0.1, =0.0.1, =0.11.0, =0.11.2 - openinghours 3.3.0 and more Source cves: CVE-2017-16008 Source advisory: GHSA-F89G-WHPF-6Q9M...

Node-RED Unauthorized Remote Command Execution Vulnerability

Node-RED is a tool for building Internet of Things IOT applications that focuses on simplifying the "connectivity" of code blocks to perform tasks. Node-RED is vulnerable to unauthorized remote command execution. Since the Node-RED application does not enforce any type of authentication,...

Cross-Site Scripting (XSS)

node-red is affected by a cross-site scripting XSS vulnerability. The use of .html does not sanitise user input and allows for injection of arbitrary JavaScript through the name parameter...

Node.js third-party modules: Stored XSS in Node-Red

I would like to report a stored XSS in node-red It allows to execute javascript in the user's browser Module module name: node-red version: v0.18.4 npm page: https://www.npmjs.com/package/node-red Module Description A visual tool for wiring the Internet of Things. Module Stats 1,758 downloads in...