227 matches found
CVE-2022-3133 OS Command Injection in jgraph/drawio
OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0...
CVE-2022-3133
CVE-2022-3133 affects the jgraph/drawio project prior to 20.3.0. The issue is an OS command injection caused by improper neutralization of input data in command construction. The vulnerability is labeled as high risk (CVSS base score 7.8/NVD; 7.0 in some metrics) with a local attack vector and us...
CVE-2022-3133: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0...
JGraph draw.io 操作系统命令注入漏洞
JGraph draw.io is a configurable chart/whiteboard visualization application from JGraph. An operating system command injection vulnerability exists in JGraph draw.io versions prior to 20.3.0, which arises from a networked system or product that does not properly filter special characters, command...
CVE-2022-3148
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
CVE-2022-3138
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
CVE-2022-3148
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
Cross site scripting
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
CVE-2022-3138
CVE-2022-3138 is a Cross-site Scripting (XSS) vulnerability in the GitHub repository for jgraph/drawio, affecting versions prior to 20.3.0. The issue stems from how the application handles a URL parameter used for refresh/back actions, leading to potential script injection via location.href witho...
CVE-2022-3138 Cross-site Scripting (XSS) - Generic in jgraph/drawio
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
CVE-2022-3148
CVE-2022-3148 describes a Cross-site Scripting (XSS) vulnerability in JGraph Draw.io (GitHub: jgraph/drawio) prior to version 20.3.0. The issue arises from how the application processes the use tag with dompurify, enabling an XSS payload to bypass CSP in some scenarios (e.g., a crafted SVG refere...
CVE-2022-3148 Cross-site Scripting (XSS) - Generic in jgraph/drawio
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
CVE-2022-3148 Cross-site Scripting (XSS) - Generic in jgraph/drawio
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
CVE-2022-3148: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
CVE-2022-3138: Improper Neutralization of Input During Web Page Generation
Cross-site Scripting XSS - Generic in GitHub repository jgraph/drawio prior to 20.3.0...
JGraph draw.io 跨站脚本漏洞
JGraph draw.io is a configurable chart/whiteboard visualization application for JGraph. A cross-site scripting vulnerability exists in JGraph draw.io versions prior to 20.3.0, which stems from the application using a parameter to specify a url on the refresh and back buttons, assigning it to...
JGraph draw.io 跨站脚本漏洞
JGraph draw.io is a configurable chart/whiteboard visualization application for JGraph. A cross-site scripting vulnerability exists in JGraph draw.io versions prior to 20.3.0, which stems from the application allowing the "use" tag to be passed to dompurify when "U" is imported before a "?" When...
CVE-2022-3127
Cross-site Scripting XSS - Stored in GitHub repository jgraph/drawio prior to 20.2.8...