CVE-2022-0776 Cross-site Scripting (XSS) - DOM in hakimel/reveal.js

Cross-site Scripting XSS - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0...

PT-2022-13430

Name of the Vulnerable Software and Affected Versions hakimel/reveal.js versions prior to 4.3.0 Description The issue is related to Cross-site Scripting XSS - DOM. Specifically, the onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding...

reveal.js 跨站脚本漏洞

reveal.js is a framework for presentation building. reveal.js versions prior to 4.3.0 have a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output, which can be exploited by attackers to execute JavaScript code on the client side...

CVE-2022-0776: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0...

Cross-site Scripting (XSS) - DOM in hakimel/reveal.js

Description The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can...

Cross-Site Scripting

Overview Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks. Recommendation Upgrade to version 3.9.2 or later References - CVE - GitHub Advisory...

Cross-site Scripting in reveal.js

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

@asciidoctor/reveal.js (>=3.0.0-rc1, <=3.1.0), ace-technical-sharing-serverless-by-joseph (1.0.1) +16 more potentially affected by CVE-2020-8127 via reveal.js (>=3.0.0, <=3.8.0)

reveal.js NPM version =3.0.0, =3.0.0-rc1, =1.1.0, =0.0.31, =1.0.0, =1.0.4, =0.0.1, =0.0.0, =0.1.0, =0.0.14, =0.1.2, =0.0.1, =0.0.15 and more Source cves: CVE-2020-8127 Source advisory: OSV:GHSA-6VWX-MWP8-FH44...

GHSA-6VWX-MWP8-FH44 Cross-site Scripting in reveal.js

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

Cross site scripting

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

CVE-2020-8127

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

CVE-2020-8127: Improper Neutralization of Input During Web Page Generation

Insufficient validation in cross-origin communication postMessage in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks...

PT-2020-19964

Name of the Vulnerable Software and Affected Versions reveal.js versions 3.9.1 and earlier Description The issue is related to insufficient validation in cross-origin communication, specifically in the postMessage functionality, which allows attackers to perform cross-site scripting attacks...

Cross-Site Scripting (XSS)

reveal.js is vulnerable to cross-site scripting XSS attacks. It is possible because it does not restrict the data such as code, description and callback from arbitrary origins and allows the SetupPostMessage to invoke methods without validating the data.method against any blacklisting, directly...

Node.js third-party modules: [reveal.js] XSS by calling arbitrary method via postMessage

I would like to report XSS in reveal.js It allows gaining access to the victim's account and performing actions on his behalf Module module name: reveal.js version: 3.8.0 npm page: https://www.npmjs.com/package/reveal.js Module Description A framework for easily creating beautiful presentations...