CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

Cross site scripting

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

CVE-2019-15607 is a stored XSS vulnerability in the node-red npm package (versions

@homenet/core (>=4.0.0-beta.15, <=4.0.0-beta.42), @jatahworx/bhive-core (>=1.0.76, <=6.2.1) +42 more potentially affected by CVE-2019-15607 via node-red (>=0.9.1, <=0.20.7)

node-red NPM version =0.9.1, =4.0.0-beta.15, =1.0.76, =1.0.0, =2.5.0, =0.0.1, =0.0.4, =0.0.0, =0.0.1, =0.0.0, =0.1.2, =0.1.0, =1.0.0, =2.1.0 - matsample 1.0.0 and more Source cves: CVE-2019-15607 Source advisory: MEND:CVE-2019-15607...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607: Improper Neutralization of Input During Web Page Generation

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

PT-2020-9729

Name of the Vulnerable Software and Affected Versions node-red versions prior to 0.20.8 Description A stored XSS issue is present in the node-red npm package, a visual tool for wiring the Internet of Things. This allows attackers to steal session cookies and deface web applications by executing...

Cross-Site Scripting

Overview Versions of node-red prior to 0.20.8are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later. References - HackerOne...

Cross-Site Scripting (XSS)

node-red is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a user's browser via the name field when renaming a flow in the Workspace dialog...

Cross-site Scripting in node-red-dashboard

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)

node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: GHSA-XG59-M7WX-853Q...

GHSA-XG59-M7WX-853Q Cross-site Scripting in node-red-dashboard

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)

node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: OSV:GHSA-XG59-M7WX-853Q...

CVE-2019-10756

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

CVE-2019-10756

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

Design/Logic Flaw

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...

CVE-2019-10756

CVE-2019-10756 affects node-red-dashboard prior to version 2.17.0 where the ui_notification node accepts raw HTML by default, enabling JavaScript injection and thus cross-site scripting (XSS). The vulnerability stems from the ability to inject script through the notification UI component, as conf...

@ia-cloud/node-red-contrib-ia-cloud-dashboard (>=0.0.1, <=0.0.4), @telligro/opal-setup (>=0.3.0, <=0.3.1) +4 more potentially affected by CVE-2019-10756 via node-red-dashboard (>=2.3.11, <=2.15.0)

node-red-dashboard NPM version =2.3.11, =0.0.1, =0.3.0, =0.0.5, =0.1.0, =0.3.3, =1.0.11, =1.0.17 Source cves: CVE-2019-10756 Source advisory: MEND:CVE-2019-10756...