CVE-2021-29489

Highcharts JS (charting library) versions 8 and earlier are vulnerable to cross-site scripting due to inadequate filtering of the chart options structure for XSS vectors. The vulnerability can allow execution of untrusted script in the end user’s browser if the configuration contains malicious in...

Highcharts JS 跨站脚本漏洞

Highcharts JS is an SVG-based JavaScript charting framework. DOMPurify is a DOM Document Object Model written in JavaScript for HTML, MathML and SVG. A cross-site scripting vulnerability exists in Highcharts JS, which can be exploited by an attacker to execute code in a browser...

Information Disclosure

highcharts-export-server is vulnerable to information disclosure. If the export server is accessible via internet, it allows reading of internal HTTP resources and outputting files served by other services on the internal network in which the export server is hosted...

Exposure of internal HTTP resources

Overview In highcharts-export-server before version 2.1.0 there is a vulnerability that allows exposure of internal HTTP resources. Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export...

Vulnerability allowing for reading internal HTTP resources

Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources. The impa...

GHSA-HFWX-C7Q6-G54C Vulnerability allowing for reading internal HTTP resources

Impact The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources. The impa...

Prototype Pollution

Amendment This was deemed not a vulnerability. Overview highcharts is a JavaScript charting library based on SVG, with fallbacks to VML and canvas for old browsers. Affected versions of this package are vulnerable to Prototype Pollution via the merge function. The function recursively merges the...

Cross-Site Scripting (XSS)

highcharts is vulnerable to cross-site scripting XSS. Lack of sanitization of href values and no URL schemes restriction allows an attacker to inject malicious javascript and get executed when a user visits the page...

@gooddata/react-components (>=7.1.0-alpha, <=7.9.2-beta.20), @gooddata/sdk-ui (8.0.0-alpha.14) +38 more potentially affected by unknown CVE via highcharts (>=7.0.0, <=7.2.1)

highcharts NPM version =7.0.0, =7.1.0-alpha, =8.0.0-alpha-afi-afi-one-4619-turn-off-lines-option-2020-09-03T22-09-02-779Z, =0.0.111, =1.1.34, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =7.3.0, =4.1.12, =6.0.0, =0.1.1, =0.1.2 - fe-chart-lib 1.0.0 and more Source cves: unknown CVE Source advisory:...

Cross-Site Scripting in highcharts

Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link...

@aqsi/ui (>=3.22.0-rc.0, <=4.15.1), @ausbom/charts (>=0.1.0, <=0.1.2) +6 more potentially affected by unknown CVE via highcharts (>=8.0.0, <=8.1.0)

highcharts NPM version =8.0.0, =3.22.0-rc.0, =0.1.0, =0.0.0, =1.3.0, =7.0.0-alpha1, =16.8.1, =1.2.8, =1.0.6, =1.0.7 Source cves: unknown CVE Source advisory: OSV:GHSA-GR4J-R575-G665...

GHSA-GR4J-R575-G665 Cross-Site Scripting in highcharts

Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link...

Regular Expression Denial of Service in highcharts

Withdrawn: Duplicate of GHSA-xmc8-cjfr-phx3...

GHSA-M45F-4828-5CV5 Regular Expression Denial of Service in highcharts

Withdrawn: Duplicate of GHSA-xmc8-cjfr-phx3...

Cross-Site Scripting

Overview Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link. Recommendation Upgrade ...

Regular Expression Denial of Service

Overview Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service ReDoS. Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. Recommendation Upgra...

@jpmorganchase/perspective-viewer-highcharts (>=0.1.7, <=0.1.13), angular-universe (>=0.0.1, <=0.0.2) +3 more potentially affected by CVE-2018-20801 via highcharts (>=6.0.1, <=6.0.7)

highcharts NPM version =6.0.1, =0.1.7, =0.0.1, =1.1.0, =2.1.0 - web-platform-library 0.0.2 - zeppelin-highmaps 1.0.0 Source cves: CVE-2018-20801 Source advisory: OSV:GHSA-XMC8-CJFR-PHX3...

Regular Expression Denial of Service in highcharts

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service ReDoS. Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. Recommendation Upgrade to...

GHSA-XMC8-CJFR-PHX3 Regular Expression Denial of Service in highcharts

Versions of highcharts prior to 6.1.0 are vulnerable to Regular Expression Denial of Service ReDoS. Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service. Recommendation Upgrade to...

Denial Of Service (DoS)

highcharts is vulnerable to denial of service. Backtracking regular expressions are permitted in js/parts/SvgRenderer.js, which would allow an attacker to perform regular expressions denial of service against the SVGRenderer component...