15 matches found
EUVD-2018-0192
Malware in sbrugna...
Cross-Site Scripting
Overview All versions of @risingstack/protect are vulnerable to Cross-Site Scripting. The isXss XSS validator has several bypasses that may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation No fix is currently available. Consider using an alternative package. T...
@risingstack/trace (2.0.1), democracyos-notifier (>=1.3.0, <=2.1.3) +1 more potentially affected by CVE-2018-3723 via defaults-deep (0.2.3)
defaults-deep NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on defaults-deep and may be impacted: - @risingstack/trace 2.0.1 - democracyos-notifier =1.3.0, =2.1.3 - oddvoter-notifier 1.1.1 Source cves: CVE-2018-3723 Source advisory:...
@risingstack/trace (2.0.1), democracyos-notifier (>=1.3.0, <=2.1.3) +1 more potentially affected by CVE-2018-3723 via defaults-deep (0.2.3)
defaults-deep NPM version 0.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on defaults-deep and may be impacted: - @risingstack/trace 2.0.1 - democracyos-notifier =1.3.0, =2.1.3 - oddvoter-notifier 1.1.1 Source cves: CVE-2018-3723 Source advisory:...
Cross-Site Scripting in @risingstack/protect
All versions of @risingstack/protect are vulnerable to Cross-Site Scripting. The isXss XSS validator has several bypasses that may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation No fix is currently available. Consider using an alternative package. The packag...
mercenary-core (>=2.19.0, <=2.62.3) potentially affected by CVE-2018-1000160 via @risingstack/protect (>=1.0.0, <=1.2.0)
@risingstack/protect NPM version =1.0.0, =2.19.0, =2.62.3 Source cves: CVE-2018-1000160 Source advisory: OSV:GHSA-VPCH-RXW3-FGX8...
mercenary-core (>=2.19.0, <=2.62.3) potentially affected by CVE-2018-1000160 via @risingstack/protect (>=1.0.0, <=1.2.0)
@risingstack/protect NPM version =1.0.0, =2.19.0, =2.62.3 Source cves: CVE-2018-1000160 Source advisory: GHSA-VPCH-RXW3-FGX8...
CVE-2018-1000160
RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in isXss function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings26 detailed in the GitHub issue ...
Cross site scripting
RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in isXss function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings26 detailed in the GitHub issue ...
CVE-2018-1000160
RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in isXss function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings26 detailed in the GitHub issue ...
CVE-2018-1000160
RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in isXss function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings26 detailed in the GitHub issue ...
CVE-2018-1000160
RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in isXss function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings26 detailed in the GitHub issue ...
CVE-2018-1000160
CVE-2018-1000160 affects RisingStack Protect
PT-2018-9331
Name of the Vulnerable Software and Affected Versions RisingStack protect versions 1.2.0 and earlier @risingstack/protect all versions Description The issue concerns a Cross Site Scripting XSS vulnerability in the isXss function, located in lib/rules/xss.js, which can result in dangerous XSS...
CVE-2018-1000160: Improper Neutralization of Input During Web Page Generation
RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting XSS vulnerability in isXss function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings26 detailed in the GitHub issue ...