375 matches found
@homenet/core (>=4.0.0-beta.15, <=4.0.0-beta.42), @jatahworx/bhive-core (>=1.0.76, <=6.2.1) +42 more potentially affected by CVE-2019-15607 via node-red (>=0.9.1, <=0.20.7)
node-red NPM version =0.9.1, =4.0.0-beta.15, =1.0.76, =1.0.0, =2.5.0, =0.0.1, =0.0.4, =0.0.0, =0.0.1, =0.0.0, =0.1.2, =0.1.0, =1.0.0, =2.1.0 - matsample 1.0.0 and more Source cves: CVE-2019-15607 Source advisory: OSV:GHSA-8W65-XJC5-9W79...
GHSA-8W65-XJC5-9W79 Cross-Site Scripting in node-red
Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...
CVE-2019-15607
A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...
CVE-2019-15607
A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...
Cross site scripting
A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...
@homenet/core (>=4.0.0-beta.15, <=4.0.0-beta.42), @jatahworx/bhive-core (>=1.0.76, <=6.2.1) +42 more potentially affected by CVE-2019-15607 via node-red (>=0.9.1, <=0.20.7)
node-red NPM version =0.9.1, =4.0.0-beta.15, =1.0.76, =1.0.0, =2.5.0, =0.0.1, =0.0.4, =0.0.0, =0.0.1, =0.0.0, =0.1.2, =0.1.0, =1.0.0, =2.1.0 - matsample 1.0.0 and more Source cves: CVE-2019-15607 Source advisory: MEND:CVE-2019-15607...
CVE-2019-15607
A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...
CVE-2019-15607
A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...
CVE-2019-15607
CVE-2019-15607 is a stored XSS vulnerability in the node-red npm package (versions
PT-2020-9729
Name of the Vulnerable Software and Affected Versions node-red versions prior to 0.20.8 Description A stored XSS issue is present in the node-red npm package, a visual tool for wiring the Internet of Things. This allows attackers to steal session cookies and deface web applications by executing...
CVE-2019-15607: Improper Neutralization of Input During Web Page Generation
A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...
Cross-Site Scripting
Overview Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later. References - HackerOne...
Cross-Site Scripting (XSS)
node-red is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the name field when renaming a flow in the Workspace dialog...
@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)
node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: OSV:GHSA-XG59-M7WX-853Q...
@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)
node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: GHSA-XG59-M7WX-853Q...
Cross-site Scripting in node-red-dashboard
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...
GHSA-XG59-M7WX-853Q Cross-site Scripting in node-red-dashboard
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...
CVE-2019-10756
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...