128 matches found
Cross site scripting
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...
CVE-2020-15119
CVE-2020-15119 concerns the auth0-lock widget. Vulnerability: using dangerouslySetInnerHTML to update the DOM can enable cross-site scripting (XSS) when Passwordless or Enterprise connections are used. Affected versions: before and including 11.25.1. Impact: potential exposure of arbitrary JavaSc...
CVE-2020-15119 DOM-based XSS in auth0-lock
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...
DOM-based XSS
Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...
CVE-2020-15119: Improper Neutralization of Input During Web Page Generation
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...
CVE-2020-12113
BigBlueButton is affected by CVE-2020-12113: prior to version 2.2.4, the Web UI is vulnerable to cross-site scripting via closed captions because dangerouslySetInnerHTML is used in React. This vulnerability allows XSS as described in multiple sources (e.g., BigBlueButton’s 2.2.4 release notes and...
CVE-2020-12113: Improper Neutralization of Input During Web Page Generation
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...
