CVE-2017-16010

creationtimestamp| type| source ---|---|--- 2018-07-24 19:58:33+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-cmh5-qc8w-xvcq...

@jenkins-cd/blueocean-core-js (0.0.21-unreleased5), angular2-i18next (>=0.0.1, <=1.1.2) +46 more potentially affected by CVE-2017-16010 via i18next (>=2.0.4, <=3.4.3)

i18next NPM version =2.0.4, =0.0.1, =0.5.0, =1.0.0-rc1, =0.15.0, =1.17.9, =0.1.17, =0.12.4-beta2, =2.0.0-rc1, =1.0.0, =0.0.2, =0.1.0 - i18next-ngx 1.2.2 and more Source cves: CVE-2017-16010 Source advisory: OSV:GHSA-CMH5-QC8W-XVCQ...

CVE-2017-16010

i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but i...

CVE-2017-16010

CVE-2017-16010 : In i18next, if you call init with interpolation options and do not set escapeValue, the value defaults to undefined, causing user input to be unescaped and enabling cross-site scripting. Affected: i18next 2.0.0 and later. Exploitation details and proof-of-concept are described in...

CVE-2017-16010

i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but i...