Design/Logic Flaw

selectize-plugin-a11y before 1.1.0 has XSS via the msg field...

CVE-2019-15482

The CVE-2019-15482 entry concerns the package selectize-plugin-a11y prior to version 1.1.0, where a Cross-Site Scripting (XSS) vulnerability exists in the msg field. The root cause, as described in the Node.js advisory, is that the accessibility.liveRegion.speak function does not sanitize the msg...

CVE-2019-15482

selectize-plugin-a11y before 1.1.0 has XSS via the msg field...

Arbitrary Code Execution

firefox is vulnerable to use-after-free vulnerability. The vulnerability exists in the mozilla::a11y::DocAccessible::ProcessInvalidationList function. Remote attackers can execute arbitrary code via an aria-owns attribute which affects the availability causing a denial of service DOS attacks...