norska (>=0.7.0, <=0.8.4), norska-frontend (>=0.7.4, <=0.9.11) +5 more potentially affected by CVE-2020-7642 via lazysizes (>=5.1.1, <=5.2.0)

lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov 0.2.4 Source cves: CVE-2020-7642 Source advisory: OSV:GHSA-HG2P-2CVQ-4PPV...

norska (>=0.7.0, <=0.8.4), norska-frontend (>=0.7.4, <=0.9.11) +5 more potentially affected by unknown CVE via lazysizes (>=5.1.1, <=5.2.0)

lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov 0.2.4 Source cves: unknown CVE Source advisory: OSV:GHSA-W4VP-3MQ7-7V82...

Cross-Site Scripting in @nuxt/devalue

Versions of @nuxt/devalue prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys. Recommendation Upgrade to version 1.2.3 or later...

CVE-2019-13506

CVE-2019-13506 affects @nuxt/devalue before 1.2.3 (used in Nuxt.js before 2.6.2). The root cause is mishandling of object keys, leading to Cross-Site Scripting (XSS). Impact: potential XSS via object keys in affected builds; CVSS ~6.1 (NVD v3). Mitigation: upgrade to @nuxt/devalue 1.2.3 or later ...

Cross-site Scripting (XSS)

vuex-router-sync is vulnerable to cross-site scripting XSS attacks. The route parameter used in the server-rendered store in Nuxt render:routeContext hook are not sanitized, allowing an attacker to insert arbitrary Javascript...

Cross-Site Scripting

Overview Versions of @nuxt/devalue prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys. Recommendation Upgrade to version 1.2.3 or later. References - GitHub Issue - GitHub Advisory...