Lucene search
Veracode Vulnerability DatabaseVERACODE:20926HistoryJul 30, 2019 - 3:23 a.m.
Cross-site Scripting (XSS)
2019-07-3003:23:28
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
0.001 Low
EPSS
Percentile
37.3%
invenio-previewer is vulnerable to cross-site scripting (XSS). It does not escape the user-uploaded file and directly render the file in the JSON, Markdown and iPython Notebook previewers, allowing an attacker to inject arbitrary Javascript into a victim’s browser using a malicious file.
| CPE | Name | Operator | Version |
|---|---|---|---|
| invenio-previewer | eq | 0.1.0 | |
| invenio-previewer | le | 1.0.0a11 |
Related
cvelist
cvelist
CVE-2019-1020019
2019-07-29 13:16:32
osv
osv
CVE-2019-1020019
2019-07-29 14:15:11
PYSEC-2019-26
2019-07-29 14:15:00
Cross-site Scripting in invenio-previewer
2019-07-16 00:52:22
cve
cve
CVE-2019-1020019
2019-07-29 14:15:11
prion
prion
Cross site scripting
2019-07-29 14:15:00
nvd
nvd
CVE-2019-1020019
2019-07-29 14:15:11
github
github
Cross-site Scripting in invenio-previewer
2019-07-16 00:52:22