ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4547 more potentially affected by CVE-2020-9484 via org.apache.tomcat.embed:tomcat-embed-core (>=8.0.1, <=8.5.54)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.0.1, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =1, =10 and more Source cves: CVE-2020-9484 Source advisory: MEND:CVE-2020-9484...

wagtail-stacks-embed (>=0.1.0, <=0.3.0) potentially affected by CVE-2020-11037 via wagtail (1.7.0)

wagtail PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-stacks-embed =0.1.0, =0.3.0 Source cves: CVE-2020-11037 Source advisory: OSV:GHSA-JJJR-3JCW-F8V6...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

Design/Logic Flaw

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642

CVE-2020-7642 affects lazysizes up to version 5.2.0, where the video-embed plugin fails to sanitize attributes data-vimeo, data-vimeoparams, data-youtube, and data-ytparams, enabling injection of malicious JavaScript. The vulnerability is tied to how untrusted payloads can be executed through the...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

PT-2020-19677

Name of the Vulnerable Software and Affected Versions lazysizes versions through 5.2.0 Description The issue allows execution of malicious JavaScript. The video-embed plugin does not sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube, and data-ytparams, which can be...

CVE-2020-7642: Improper Neutralization of Input During Web Page Generation

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

Cross-site Scripting (XSS)

Overview lazysizes is a fast jank-free, SEO-friendly and self-initializing lazyloader for images including responsive images picture/srcset, iframes, scripts/widgets and much more. It also prioritizes resources by differentiating between crucial in view and near view elements to make perceived...

Cross-Site Scripting

Overview Versions of lazysizes prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting. The video-embed plugin fails to sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube and data-ytparams. This allows attackers to execute arbitrary JavaScript in a victim's browser if...

Server-Side Request Forgery (SSRF)

ghost is vulnerable to server-side request forgery SSRF. An attacker with the publisher role editor, author, contributor, administrator in a blog is able to exploit the vulnerability in the embed content module to make arbitrary GET requests in a on behalf of the server, allowing discovery of...

Cross-Site Scripting (XSS)

lazysizes is vulnerable to cross-site scripting XSS. The attributes data-vimeo, data-vimeoparams, data-youtube and data-ytparams are not sanitized by the video-embed plugin, allowing a remote attacker to inject and execute arbitrary Javascript in the user's browser via the affected parameters...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.99), org.apache.tomcat.embed:tomcat-embed-websocket (7.0.99) +1 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (7.0.99)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.99 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.99 -...

cn.springboot:best-pay-sdk (>=1.3.3, <=1.3.7), com.aceql:aceql-http (>=4.0, <=4.1) +42 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.49, <=8.5.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.49, =1.3.3, =4.0, =3.0.6, =3.0.6, =3.0.6, =3.0.6, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.11 - com.heroku:webapp-runner 8.5.50.0 and more Source cves: CVE-2019-17569 Source advisory: OSV:GHSA-767J-JFH2-JVRC...

org.apache.tomcat.embed:tomcat-embed-jasper (7.0.99), org.apache.tomcat.embed:tomcat-embed-websocket (7.0.99) +1 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (7.0.99)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 7.0.99 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - org.apache.tomcat.embed:tomcat-embed-jasper 7.0.99 -...

ai.hyacinth.framework:core-service-admin-server (0.5.24), ai.hyacinth.framework:core-service-config-server (0.5.24) +831 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.29, <=9.0.30)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.29, =0.0.1, =1.6, =1.8 - cloud.altemista.fwk.framework:cloud-altemistafwk-boot-conf 3.1.0.release - cloud.altemista.fwk.framework:cloud-altemistafwk-documentation 3.1.0.release -...

cn.springboot:best-pay-sdk (>=1.3.3, <=1.3.7), com.aceql:aceql-http (>=4.0, <=4.1) +42 more potentially affected by CVE-2019-17569 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.49, <=8.5.50)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.49, =1.3.3, =4.0, =3.0.6, =3.0.6, =3.0.6, =3.0.6, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.9, =3.0.11 - com.heroku:webapp-runner 8.5.50.0 and more Source cves: CVE-2019-17569 Source advisory: GHSA-767J-JFH2-JVRC...