GHSA-X9R5-JXVQ-4387 jquery.terminal self XSS on user input

Impact This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code the victim sees. Also if the application use execHash option and execute code from URL the attacker can use this URL to execute his code. The scope is...

@esfaenza/core (>=15.2.16, <=19.2.114) potentially affected by CVE-2021-43862 via jquery.terminal (2.23.2)

jquery.terminal NPM version 2.23.2 is affected by a known vulnerability. The following packages have a transitive dependency on jquery.terminal and may be impacted: - @esfaenza/core =15.2.16, =19.2.114 Source cves: CVE-2021-43862 Source advisory: OSV:GHSA-X9R5-JXVQ-4387...

Cross-site Scripting (XSS)

jquery.terminal is vulnerable to cross-site scripting. The use of execHash option code from URL allows an attacker to execute malicious code via URL. Note: Javascript attribute used is added to span tag , therefore allowing no automatic execution like with onerror...

Reflected Cross-Site Scripting in jquery.terminal

Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization...

GHSA-2HWP-G4G7-MWWJ Reflected Cross-Site Scripting in jquery.terminal

Versions of jquery.terminal prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options anyLinks or invokeMethods set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization...

cmd-resume (>=3.0.72, <=3.1.0) potentially affected by unknown CVE via jquery.terminal (1.4.3)

jquery.terminal NPM version 1.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on jquery.terminal and may be impacted: - cmd-resume =3.0.72, =3.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-2HWP-G4G7-MWWJ...