EUVD-2020-0280

Malware in sbrugna...

CVE-2019-20174

Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder...

CVE-2019-20174

Auth0 Lock prior to version 11.21.0 is vulnerable to cross-site scripting when additionalSignUpFields uses an untrusted placeholder. The issue is triggered by untrusted placeholder content being rendered in the Sign Up dialog, enabling XSS. Red Hat and OSV records corroborate the same description...

Cross-Site Scripting (XSS)

Auth0-Lock is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary and execute arbitrary Javascript into a user's browser via the placeholder property. Customers using the additionalSignUpFields customization option are affected...