@dotgov/bpmn (>=0.0.1 <=0.0.29), @dotgov/z_bpmn (>=0.0.1 <=2.0.0) +14 more potentially affected by unknown CVE via diagram-js-direct-editing (>=0.17.1 <=0.9.0)

diagram-js-direct-editing NPM version =0.17.1, =0.0.1, =0.0.1, =1.0.0, =0.5.0, =1.20.7, =0.7.2, =1.0.0, =1.0.0, =0.2.2, =0.0.7, =2.0.0, =2.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-J8R2-2X94-2Q67...

Cross-Site Scripting in diagram-js-direct-editing

Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.3 or later...

GHSA-J8R2-2X94-2Q67 Cross-Site Scripting in diagram-js-direct-editing

Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.3 or later...

@5minds/node-red-dashboard-2-processcube-dynamic-form (>=1.0.25-poc-for-using-dynamic-ui-from-app-sdk-4a73f4-m2ok3vom <=1.0.25-poc-for-using-dynamic-ui-from-app-sdk-d41e60-m2oo8xvq), @5minds/processcube_app_sdk (>=5.1.0-feature-1c1233-lsdsso3l <=8.6.2) +352 more potentially affected by unknown CVE via diagram-js (>=0.18.4 <=1.4.0)

diagram-js NPM version =0.18.4, =1.0.25-poc-for-using-dynamic-ui-from-app-sdk-4a73f4-m2ok3vom, =5.1.0-feature-1c1233-lsdsso3l, =1.2.0, =0.1.0-package-6ccc4e-lyitv9ph, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =1.0.98, =0.0.25, =0.3.0, =1.0.0, =0.0.1-alpha.0, =0.3.0 - @bptlab/openbpt-modeler-bpmn =1.0.0 and...

GHSA-8FW4-XH83-3J6Q Cross-Site Scripting in diagram-js

Versions of diagram-js prior to 3.3.1 for 3.x and 2.6.2 for 2.x are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript. Recommendation If you are using diagram-js 3.x, upgrade to version...

Cross-Site Scripting in diagram-js

Versions of diagram-js prior to 3.3.1 for 3.x and 2.6.2 for 2.x are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript. Recommendation If you are using diagram-js 3.x, upgrade to version...

Cross-Site Scripting (XSS)

diagram-js-direct-editing is vulnerable to cross-site scripting. The vulnerability exists due to lack of sanitization when pasting HTML code from user's clipboard into the edit box which allows remote attackers to inject and execute arbitrary javascript...

Cross-Site Scripting

Overview Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.3 or later. References -...

Cross-Site Scripting

Overview Versions of diagram-js prior to 3.3.1 for 3.x and 2.6.2 for 2.x are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript. Recommendation If you are using diagram-js 3.x, upgrade t...