PT-2022-7694 · Drawio +1 · Drawio +1

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 20.3.0 Description: The issue is related to the incorrect neutralization of special elements used in an OS command, which can allow a remote attacker to execute arbitrary commands. Recommendations: For versions prior ...

CVE-2022-3065

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...

CVE-2022-3065

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...

CVE-2022-3065 Improper Access Control in jgraph/drawio

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...

CVE-2022-3065

CVE-2022-3065 corresponds to an Improper Access Control in the GitHub repository jgraph/drawio, affecting versions prior to 20.2.8. Multiple connected sources describe the issue as arising from inadequate access control tied to the proxy URL parameter, with no rate‑limiting, which could enable ab...

CVE-2022-3065 Improper Access Control in jgraph/drawio

Improper Access Control in GitHub repository jgraph/drawio prior to 20.2.8...

PT-2022-20226 · Unknown · Jgraph/Drawio

Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 20.2.8 Description: The issue is related to improper access control in the GitHub repository jgraph/drawio. Recommendations: For versions prior to 20.2.8, update to version 20.2.8 or later to resolve the issue...

The vulnerability of the url.openConnection() method in Embed2 software, a service for creating drawio diagrams, allows a attacker to perform an SSRF attack.

The vulnerability of the url.openConnection method in Embed2 software, which is used for creating drawio diagrams, is related to insufficient validation of incoming requests. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack by sending a specially crafted HTTP...

Forward credential header to attacker host

Description Some Admins set the "Authorization" header with the help of a reverse proxy to restrict initial access to the Drawio application server. In this kind of setup, the "Authorization" header should always be sent to the reverse proxy, and the reverse proxy will forward it to Drawio But Th...

CVE-2022-2015

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 19.0.2...

CVE-2022-2014

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2...

CVE-2022-2015

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 19.0.2...

CVE-2022-2014

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2...

Code injection

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2...

JGraph draw.io 跨站脚本漏洞

JGraph draw.io is a configurable chart/whiteboard visualization application from JGraph. A security vulnerability exists in JGraph draw.io versions prior to 19.0.2 that stems from a cross-site scripting XSS issue...

CVE-2022-2015 Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 19.0.2...

CVE-2022-2015

CVE-2022-2015 affects jgraph/drawio prior to 19.0.2 with a stored XSS vulnerability. The issue is in the GitHub repository and requires upgrade to 19.0.2 or later to remediate. Exploit details are not provided in the connected documents.

CVE-2022-2015 Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 19.0.2...

CVE-2022-2014 Code Injection in jgraph/drawio

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2...

CVE-2022-2014

CVE-2022-2014 affects the jgraph/drawio project prior to 19.0.2. The connected sources describe a vulnerability in how diagram data is deserialized, enabling code injection via diagram content (notably unsafe deserialization of diagram elements and attributes), which can lead to client-side remot...