EUVD-2021-1081

Malware in sbrugna...

GHSA-GMCH-CM2P-9QW9 Cross-site Scripting in lightning-server

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

Cross-site Scripting in lightning-server

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

lightning-server cross-site scripting vulnerability

lightning-server is a personal developer Npm library for data visualization applications . The library provides API-based access to reproducible Web-based interactive visualizations. A security vulnerability exists in all versions of lightning-server, which can be exploited by an attacker to inje...

Cross-site Scripting (XSS)

lightning-server is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute malicious script in a user's browser via an error message in the session controller's addData function...

CVE-2020-7747

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

CVE-2020-7747

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

CVE-2020-7747 Cross-site Scripting (XSS)

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

CVE-2020-7747

CVE-2020-7747 – Cross-site Scripting in lightning-server (session controller) . Several connected sources confirm that lightning-server is vulnerable to XSS across all versions, allowing injection of malicious JavaScript via the session controller. A PoC demonstrates posting a crafted payload in ...

CVE-2020-7747

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

CVE-2020-7747

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

CVE-2020-7747: Improper Neutralization of Input During Web Page Generation

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller...

PT-2020-19763

Name of the Vulnerable Software and Affected Versions lightning-server affected versions not specified Description The issue allows for the injection of malicious JavaScript code as part of a session controller, potentially leading to unauthorized access or control. Recommendations At the moment,...

Cross-site Scripting (XSS)

Overview lightning-server is a lightning dataviz notebooks server. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible to inject malicious JavaScript code as part of a session controller. PoC POST...

alchemy-embed-medias (>=0.4.0, <=0.5.0), globe-iframe-resizer (>=0.0.0, <=0.0.2) +4 more potentially affected by CVE-2018-1000086 via pym.js (0.4.5)

pym.js NPM version 0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on pym.js and may be impacted: - alchemy-embed-medias =0.4.0, =0.0.0, =0.2.1, =0.1.0, =0.3.0, =1.0.0, =4.0.0 Source cves: CVE-2018-1000086 Source advisory: GHSA-82GW-PQF7-Q3J2...

alchemy-embed-medias (>=0.4.0, <=0.5.0), globe-iframe-resizer (>=0.0.0, <=0.0.2) +4 more potentially affected by CVE-2018-1000086 via pym.js (0.4.5)

pym.js NPM version 0.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on pym.js and may be impacted: - alchemy-embed-medias =0.4.0, =0.0.0, =0.2.1, =0.1.0, =0.3.0, =1.0.0, =4.0.0 Source cves: CVE-2018-1000086 Source advisory: MEND:CVE-2018-1000086...