CVE-2022-24718

CVE-2022-24718 affects the ssr-pages HTML page builder. A path traversal vulnerability exists when untrusted input is provided to the svg property as an argument to build(MessagePageOptions). The issue is present in versions prior to 0.1.4. A patch is available in version 0.1.4 (upgrade to 0.1.4 ...

CVE-2022-24717 Cross Site Scripting (XSS) in ssr-pages

ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. In versions prior to 0.1.5, a cross site scripting XSS issue can occur when providing untrusted input to the redirect.link property as an argument to the buildMessagePageOptions function. While there is no known...

CVE-2022-24717 Cross Site Scripting (XSS) in ssr-pages

ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. In versions prior to 0.1.5, a cross site scripting XSS issue can occur when providing untrusted input to the redirect.link property as an argument to the buildMessagePageOptions function. While there is no known...

SSR-pages 跨站脚本漏洞

Ssr Pages is an Html page builder for Ssr server-side rendering. Ssr Pages suffers from a cross-site scripting vulnerability that can be exploited by an attacker to provide untrusted input to a redirect, resulting in cross-site scripting...

CVE-2022-24718: Improper Limitation of a Pathname to a Restricted Directory

ssr-pages is an HTML page builder for the purpose of server-side rendering SSR. In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the svg property as an argument to the buildMessagePageOptions function. While there is no known workaround at this time,...

123-x-ed-eied (>=1.0.5, <=1.0.6), @0soft/use-nextjs-page-loader (>=0.0.23-alpha.5, <=0.0.25) +855 more potentially affected by CVE-2022-23646 via next (>=10.0.0, <=12.0.10)

next NPM version =10.0.0, =1.0.5, =0.0.23-alpha.5, =0.0.1, =1.1.7, =0.1.0, =1.1.1, =0.0.25, =1.0.39, =0.0.0, =1.0.0, =1.6.1 and more Source cves: CVE-2022-23646 Source advisory: OSV:GHSA-FMVM-X8MV-47MJ...

123-x-ed-eied (>=1.0.5, <=1.0.6), @andrydharmawan/component-react (>=1.1.1, <=1.1.4) +111 more potentially affected by CVE-2022-21721 via next (>=12.0.0, <=12.0.8)

next NPM version =12.0.0, =1.0.5, =1.1.1, =0.0.41, =2.0.2, =2.0.1, =0.0.5, =1.9.6, =1.0.2, =0.0.0-34, =0.0.15, =1.1.0 and more Source cves: CVE-2022-21721 Source advisory: OSV:GHSA-WR66-VRWM-5G5X...

3nit-components (>=0.0.2, <=0.0.4), 3nit-utils (>=0.3.0, <=1.0.2) +1329 more potentially affected by CVE-2021-43803 via next (>=1.2.3, <=11.1.2)

next NPM version =1.2.3, =0.0.2, =0.3.0, =0.0.0-canary.0, =0.0.1, =1.0.0, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2021-43803 Source advisory: OSV:GHSA-25MP-G6FV-MQXX...

123-x-ed-eied (>=1.0.5, <=1.0.6), @builderx-framework/bx-app-service-web (0.0.1) +48 more potentially affected by CVE-2021-43803 via next (>=12.0.0, <=12.0.4)

next NPM version =12.0.0, =1.0.5, =0.0.41, =2.0.2, =2.0.1, =0.0.5, =1.9.6, =0.0.0-34, =1.0.2, =1.0.0, =0.0.2, =0.0.62, =0.7.4-alpha.0, =0.7.4-alpha.0, =0.7.7-alpha.0 and more Source cves: CVE-2021-43803 Source advisory: OSV:GHSA-25MP-G6FV-MQXX...

@draadnl/openstad-cms (>=0.12.2, <=0.12.3), apostrophe-personas (>=2.0.0, <=2.2.1) +1 more potentially affected by CVE-2021-25978 via apostrophe (>=2.107.2, <=2.227.12)

apostrophe NPM version =2.107.2, =0.12.2, =2.0.0, =2.2.1 - apostrophe-selective-permissions 2.0.0 Source cves: CVE-2021-25978 Source advisory: OSV:GHSA-4R9C-JGHC-CX5M...

3nit-components (>=0.0.2, <=0.0.4), 3nit-utils (>=0.3.0, <=1.0.2) +1234 more potentially affected by CVE-2021-37699 via next (>=1.2.3, <=11.0.1)

next NPM version =1.2.3, =0.0.2, =0.3.0, =0.0.0-canary.0, =0.0.1, =1.0.0, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2021-37699 Source advisory: OSV:GHSA-VXF5-WXWP-M7G9...

@shoplo/kit-vue (>=1.17.0, <=1.22.16), dm-cli (>=0.4.1-0, <=0.4.5) potentially affected by CVE-2021-23342 via docsify (>=4.2.1, <=4.9.1)

docsify NPM version =4.2.1, =1.17.0, =0.4.1-0, =0.4.5 Source cves: CVE-2021-23342 Source advisory: OSV:GHSA-2MM9-C2FX-C7M4...

@blitzjs/server (>=0.16.5-canary.8, <=0.24.1), @brudi-toolbox/next (>=1.14.17-next.2, <=1.14.26) +30 more potentially affected by CVE-2020-15242 via next (>=9.5.0, <=9.5.3)

next NPM version =9.5.0, =0.16.5-canary.8, =1.14.17-next.2, =1.13.4, =0.1.8-alpha.1, =0.0.1-1, =0.16.0, =0.31.0-RC.1, =1.10.8, =1.0.0-alpha.1, =1.0.0-alpha.0, =0.16.5-canary.8, =0.20.0 - cna-template-material-tailwindcss-reduxtoolkit 0.1.0 and more Source cves: CVE-2020-15242 Source advisory:...

XSS in client rendered block templates in rendr

Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a block. Server side rendering is not affected and is properly escaped. Recommendation Update to version 1.1.4 or later...

Denial Of Service (DoS) Via Infinite Loop

graphql-hooks is vulnerable to denial of service DoS attacks. Since skipCache is set to true by default in the function useQuery during server side rendering, an attacker can send the query requests to trigger infinite loop as it runs indefinitely without raising any error or returning any result...

GHSA-MVJJ-GQQ2-P4HW Cross-Site Scripting in react-dom

Affected versions of react-dom are vulnerable to Cross-Site Scripting XSS. The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by...

The React application in the most common XSS exploits and Defense-vulnerability warning-the black bar safety net

The author has been firmly React technology stack of the user, and therefore will pay attention to the React application security related topics. The author in my ownReact+Redux+Webpack2scaffolding the third level also uses a lot of server-side rendering/isomorphism straight out of the technology...