CVE-2022-2014 Code Injection in jgraph/drawio

Code Injection in GitHub repository jgraph/drawio prior to 19.0.2...

Command execution vulnerability in JGraph drawio-desktop

drawio-desktop is an Electron-based diagramming and whiteboarding desktop application. A command execution vulnerability exists in JGraph drawio-desktop that can be exploited by an attacker to cause code execution...

CVE-2022-1815

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2...

CVE-2022-1815

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2...

CVE-2022-1815 Exposure of Sensitive Information to an Unauthorized Actor in jgraph/drawio

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2...

CVE-2022-1815

Drawio (jgraph/drawio) prior to version 18.1.2 is affected by a server-side request forgery (SSRF) via the /service endpoint. The Nuclei template and related sources confirm an SSRF that could allow an attacker to obtain sensitive information, modify data, or perform unauthorized administrative a...

SSRF in /service endpoint

Description The problem came from this line of code I ran docker-drawio with following command : docker run -it --rm --name="draw" -e EXPORTURL=http://somesite.com -p 8080:8080 -p 8443:8443 jgraph/drawio if the drawio EXPORTURL is set to an address without any / after the primary Hostname like...

CVE-2022-1784

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.8...

CVE-2022-1784

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.8...

Server side request forgery (ssrf)

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.8...

CVE-2022-1784

CVE-2022-1784 affects jgraph/drawio prior to 18.0.8 with a Server-Side Request Forgery (SSRF). The connected Huntr entry details an SSRF vector in EmbedServlet2.java where redirects are followed by default via url.openConnection(), and the redirections are not validated, enabling an attacker to r...

CVE-2022-1784 Server-Side Request Forgery (SSRF) in jgraph/drawio

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.8...

CVE-2022-1784 Server-Side Request Forgery (SSRF) in jgraph/drawio

Server-Side Request Forgery SSRF in GitHub repository jgraph/drawio prior to 18.0.8...

CVE-2022-1730

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 18.0.4...

CVE-2022-1730

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 18.0.4...

Cross site scripting

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 18.0.4...

CVE-2022-1730 Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 18.0.4...

CVE-2022-1730

CVE-2022-1730 affects jgraph/drawio (prior to version 18.0.4). The stored XSS vulnerability arises from insufficient data validation/filtering of user-supplied data, allowing injected scripts to be stored and later executed in the client. Impact is client-side script execution (XSS) for affected ...

CVE-2022-1730 Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 18.0.4...

PT-2022-14079 · Jgraph · Jgraph/Drawio

Name of the Vulnerable Software and Affected Versions: jgraph/drawio versions prior to 18.0.4 Description: The issue is related to Cross-site Scripting XSS - Stored. This means that an attacker can inject malicious scripts into a website, which are then stored on the server and executed by other...