Veracode Vulnerability DatabaseVERACODE:39386Cross-Site Scripting (XSS)
0.001 Low
EPSS
Percentile
45.4%
@claviska/jquery-minicolors is vulnerable to Cross-Site Scripting (XSS). The vulnerability is due to a lack of santization in name parameter of jquery.minicolors.js, which allows an attacker to inject and execute arbitrary JavaScript in to the browser.
| CPE | Name | Operator | Version |
|---|---|---|---|
| @claviska/jquery-minicolors | le | 2.3.5 | |
| jquery-minicolors | le | 2.3.4 | |
| @claviska/jquery-minicolors | le | 2.3.5 | |
| jquery-minicolors | le | 2.3.4 |
References
github.com/advisories/GHSA-crh5-vv2v-c82q
github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3
github.com/claviska/jquery-minicolors/releases/tag/2.3.6
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F/
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO/
lists.fedoraproject.org/archives/list/[email protected]/message/MC5HV4ESLV2E23YGHNJ542QEZBH6YE2F/
lists.fedoraproject.org/archives/list/[email protected]/message/UDXBWA54A7D6HMR2TN5BAYNCU7HO2PUO/
securitylab.github.com/advisories/GHSL-2021-1045_jQuery_MiniColors_Plugin/
Related
