CVE-2023-24065

NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...

CVE-2023-24065

The CVE-2023-24065 entry affects NOSH (version 4a5cfdb) and describes a stored XSS vulnerability on the create user page. A crafted first name field can execute JavaScript when visiting /users/2/1, with potential to exfiltrate Protected Health Information in a healthcare-charting context. Public ...

NOSH ChartingSystem 跨站脚本漏洞

NOSH ChartingSystem is an electronic health record system designed for physicians and patients. A security vulnerability exists in NOSH ChartingSystem. An attacker could exploit the vulnerability to steal protected health information...

CVE-2023-24065: Improper Neutralization of Input During Web Page Generation

NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...

CVE-2023-24065

NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...

CVE-2022-31108

Summary of CVE-2022-31108 (mermaid.js) : The vulnerability allows an attacker to inject arbitrary CSS into the generated graph, enabling styling changes to elements outside the SVG and potential information disclosure via CSS selectors that trigger HTTP requests. The issue is tied to how user inp...

MAL-2022-1885 Malicious code in charting-library-angular5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0951e2547b550ff0a715125f78bd5fe0e8f2ed31b905487677cc4bb51b20785 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in charting-library-angular5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0951e2547b550ff0a715125f78bd5fe0e8f2ed31b905487677cc4bb51b20785 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in charting-library-react-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cba3185261bbaca364e13eb20f22442df73c6fa2a62f6387cb1a6215d99ecd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1886 Malicious code in charting-library-react-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cba3185261bbaca364e13eb20f22442df73c6fa2a62f6387cb1a6215d99ecd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @distributedcollective/charting-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 106e4598660bf87b449fb5fff15133f2ecda8ad43b249799bb6932dbf74b50fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-204 Malicious code in @distributedcollective/charting-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 106e4598660bf87b449fb5fff15133f2ecda8ad43b249799bb6932dbf74b50fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Xfig 资源管理错误漏洞

Xfig is a charting tool. A utility program for converting XFig graphic files. A security vulnerability exists in Xfig where an attacker may be able to cause a denial of service via the freestream function in readpics.c...

CVE-2021-43861

CVE-2021-43861 affects Mermaid (JavaScript diagramming tool). The vulnerability occurs in versions prior to 8.13.8 where crafted diagrams can execute JavaScript on readers’ machines. The advisory/records in connected documents confirm the issue, its impact, and the remediation: upgrade Mermaid to...

Highcharts JS Cross-Site Scripting Vulnerability

Highcharts JS is an SVG-based JavaScript charting framework. DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A cross-site scripting vulnerability exists in Highcharts JS, which can be exploited by an attacker to execute code in a browser...

CVE-2021-29489

Highcharts JS (charting library) versions 8 and earlier are vulnerable to cross-site scripting due to inadequate filtering of the chart options structure for XSS vectors. The vulnerability can allow execution of untrusted script in the end user’s browser if the configuration contains malicious in...

@aqsi/ui (>=3.22.0-rc.0, <=4.15.1), @ausbom/charts (>=0.1.0, <=0.1.2) +6 more potentially affected by unknown CVE via highcharts (>=8.0.0, <=8.1.0)

highcharts NPM version =8.0.0, =3.22.0-rc.0, =0.1.0, =0.0.0, =1.3.0, =7.0.0-alpha1, =16.8.1, =1.2.8, =1.0.6, =1.0.7 Source cves: unknown CVE Source advisory: OSV:GHSA-GR4J-R575-G665...

[SECURITY] Fedora 32 Update: swt-chart-0.12.0-3.fc32

SWTChart is a light-weight charting component for SWT...

Security Bulletin: WebSphere Dashboard Framework contains a vulnerability that allows file access and deletion.

Summary WebSphere Dashboard Framework contains a vulerability in a charting feature used to access and delete generated images in a temporary folder. A fix has been created that removes the vulnerability. Vulnerability Details WebSphere Dashboard Framework contains a vulnerability in a charting...

CVE-2018-17925

Multiple instances of this vulnerability Unsafe ActiveX Control Marked Safe For Scripting have been identified in the third-party ActiveX object provided to GE iFIX versions 2.0 - 5.8 by Gigasoft. Only the independent use of the Gigasoft charting package outside the iFIX product may expose users ...