@homenet/core (>=4.0.0-beta.15, <=4.0.0-beta.42), @jatahworx/bhive-core (>=1.0.76, <=3.3.1) +29 more potentially affected by unknown CVE via node-red (>=0.9.1, <=0.18.3)

node-red NPM version =0.9.1, =4.0.0-beta.15, =1.0.76, =2.5.0, =0.0.1, =0.0.4, =0.0.0, =0.0.1, =0.1.2, =0.1.0, =1.0.0, =0.9.0, =1.1.0, =1.0.0, =1.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5G6J-8HV4-VFGJ...

GHSA-5G6J-8HV4-VFGJ Cross-Site Scripting in node-red

Versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...

Cross-Site Scripting in node-red

Versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...

homestar-samsung-smart-tv (>=0.0.1, <=0.0.19), node-red-contrib-samsungtv (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via samsung-remote (1.2.5)

samsung-remote NPM version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on samsung-remote and may be impacted: - homestar-samsung-smart-tv =0.0.1, =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-XHJX-MFR6-9RR4...

GHSA-8W65-XJC5-9W79 Cross-Site Scripting in node-red

Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...

@homenet/core (>=4.0.0-beta.15, <=4.0.0-beta.42), @jatahworx/bhive-core (>=1.0.76, <=6.2.1) +42 more potentially affected by CVE-2019-15607 via node-red (>=0.9.1, <=0.20.7)

node-red NPM version =0.9.1, =4.0.0-beta.15, =1.0.76, =1.0.0, =2.5.0, =0.0.1, =0.0.4, =0.0.0, =0.0.1, =0.0.0, =0.1.2, =0.1.0, =1.0.0, =2.1.0 - matsample 1.0.0 and more Source cves: CVE-2019-15607 Source advisory: OSV:GHSA-8W65-XJC5-9W79...

Cross-Site Scripting in node-red

Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

Cross site scripting

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

CVE-2019-15607 is a stored XSS vulnerability in the node-red npm package (versions

Cross-Site Scripting

Overview Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later. References - HackerOne...

Cross-Site Scripting (XSS)

node-red is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the name field when renaming a flow in the Workspace dialog...

@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)

node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: OSV:GHSA-XG59-M7WX-853Q...

Cross-site Scripting in node-red-dashboard

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

GHSA-XG59-M7WX-853Q Cross-site Scripting in node-red-dashboard

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

CVE-2019-10756

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

CVE-2019-10756

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

Design/Logic Flaw

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...