WS-2019-0256

In buefy, versions prior to 0.7.2 are vulnerable to Cross-Site Scripting when the autocomplete list renders user input as HTML without encoding...

Cross-Site Scripting in buefy

Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders user input as HTML without encoding. Recommendation Upgrade to version 0.7.2 or later...

PT-2020-21600

Name of the Vulnerable Software and Affected Versions buefy versions prior to 0.7.2 Description The issue allows attackers to manipulate the DOM and execute remote code due to Cross-Site Scripting. This is caused by the autocomplete list rendering user input as HTML without encoding...

CVE-2013-1925: Undefined Security Weakness

The Chaos Tool Suite ctools module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which allows remote authenticated users with the "access content" permission to read restricted node titles via an autocomplete list...

PT-2013-3473

Name of the Vulnerable Software and Affected Versions The Chaos Tool Suite ctools module versions 7.x-1.x through 7.x-1.2 Description The issue allows remote authenticated users with the access content permission to read restricted node titles via an autocomplete list, due to improper restriction...