EUVD-2018-0192

Malware in sbrugna...

Cross-Site Scripting in @risingstack/protect

All versions of @risingstack/protect are vulnerable to Cross-Site Scripting. The isXss XSS validator has several bypasses that may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation No fix is currently available. Consider using an alternative package. The packag...

mercenary-core (>=2.19.0, <=2.62.3) potentially affected by CVE-2018-1000160 via @risingstack/protect (>=1.0.0, <=1.2.0)

@risingstack/protect NPM version =1.0.0, =2.19.0, =2.62.3 Source cves: CVE-2018-1000160 Source advisory: OSV:GHSA-VPCH-RXW3-FGX8...

mercenary-core (>=2.19.0, <=2.62.3) potentially affected by CVE-2018-1000160 via @risingstack/protect (>=1.0.0, <=1.2.0)

@risingstack/protect NPM version =1.0.0, =2.19.0, =2.62.3 Source cves: CVE-2018-1000160 Source advisory: GHSA-VPCH-RXW3-FGX8...

CVE-2018-1000160

RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in isXss function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings26 detailed in the GitHub issue ...

PT-2018-9331

Name of the Vulnerable Software and Affected Versions RisingStack protect versions 1.2.0 and earlier @risingstack/protect all versions Description The issue concerns a Cross Site Scripting XSS vulnerability in the isXss function, located in lib/rules/xss.js, which can result in dangerous XSS...

CVE-2018-1000160: Improper Neutralization of Input During Web Page Generation

RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in isXss function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings26 detailed in the GitHub issue ...