168 matches found
DOM-based XSS
Overview Versions before and including 11.25.1 are using dangerouslySetInnerHTML to display an informational message when used with a Passwordless or Enterprise connection. For Passwordless connection, the value of the input email or phone number is displayed back to the user while waiting for...
CVE-2020-15119: Improper Neutralization of Input During Web Page Generation
In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting XSS attacks...
PT-2020-14200
Name of the Vulnerable Software and Affected Versions auth0-lock versions prior to 11.26.3 Description The issue exposes applications and their users to cross-site scripting XSS attacks due to the use of dangerouslySetInnerHTML to update the DOM. This occurs when auth0-lock is used with...
CVE-2020-12113
BigBlueButton is affected by CVE-2020-12113: prior to version 2.2.4, the Web UI is vulnerable to cross-site scripting via closed captions because dangerouslySetInnerHTML is used in React. This vulnerability allows XSS as described in multiple sources (e.g., BigBlueButton’s 2.2.4 release notes and...
CVE-2020-12113
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...
CVE-2020-12113: Improper Neutralization of Input During Web Page Generation
BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used...
PT-2020-13044
Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.2.4 Description The issue allows for XSS via closed captions due to the use of dangerouslySetInnerHTML in React. Recommendations For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the iss...
