NPM: Ghost: Mobiledoc image-size fetch SSRF

NPM: Ghost: Mobiledoc image-size fetch SSRF vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...

Server-side Request Forgery (SSRF)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the populateImageSizes process in ghost/core/core/server/lib/mobiledoc.js. An authenticated staff user can trigger the server to make outbound requests to attacker-chos...

EUVD-2022-6572

Malicious code in bioql PyPI...

CVE-2022-2932

Cross-site Scripting XSS - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2...

The vulnerability of the WYSIWYG editor in the Mobiledoc Kit exists due to the lack of measures taken to protect the structure of web pages. This allows attackers to execute XSS attacks.

The vulnerability of the Mobiledoc Kit WYSIWYG editor exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

GHSA-HW2P-XQHQ-3MJF Cross site scripting in mobiledoc-kit

Cross-site Scripting XSS - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2...

@boundless-inc/ember-mobiledoc-editor (0.5.13-boundless), @cardstack/mobiledoc (>=0.0.1, <=0.13.50) +21 more potentially affected by CVE-2022-2932 via mobiledoc-kit (>=0.6.0, <=0.12.5)

mobiledoc-kit NPM version =0.6.0, =0.0.1, =0.0.29, =0.1.0, =0.1.22, =0.1.6, =0.0.2, =0.4.4, =0.14.3, =0.6.3, =0.1.18, =0.0.14, =0.7.5, =0.14.2 - cardstack-cms 0.0.1 - cardstack-editor 0.0.2 and more Source cves: CVE-2022-2932 Source advisory: OSV:GHSA-HW2P-XQHQ-3MJF...

Cross site scripting in mobiledoc-kit

Cross-site Scripting XSS - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2...

CVE-2022-2932

Cross-site Scripting XSS - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2...

CVE-2022-2932

Cross-site Scripting XSS - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2...

CVE-2022-2932

CVE-2022-2932 is a reflected XSS in mobiledoc-kit before 0.14.2. Public sources (GitHub/bustle/mobiledoc-kit, OSVGHSA, NVD) consistently describe the vulnerability as a client-side XSS via input processed by the library’s rendering chain, with the likely root cause in URL sanitization logic in th...

CVE-2022-2932 Cross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kit

Cross-site Scripting XSS - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2...

CVE-2022-2932 Cross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kit

Cross-site Scripting XSS - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2...

mobiledoc-kit 跨站脚本漏洞

mobiledoc-kit is an American Bustle open source toolkit for building WYSIWYG editors using Mobiledoc. A cross-site scripting vulnerability exists in versions of mobiledoc-kit prior to 0.14.2. An attacker could exploit this vulnerability to perform cross-site scripting attacks...