Cross Site Scripting(XSS)

🗓️ 17 Sep 2024 04:15:31Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 8 Views

DOMPurify is vulnerable to Cross-Site Scripting due to improper depth checking and prototype pollution.

Reporter	Title	Published	Views	Family All 66
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is vulnerable to client-side vulnerability (CVE-2024-45801)	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: User Behavior Analytics application add on to IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	20 Nov 202413:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana is affected by Multiple Security Vulnerabilities	18 Nov 202415:04	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in DOMPurify affects IBM watsonx Assistant for IBM Cloud Pak for Data	5 Feb 202520:44	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for Oct 2024	14 Oct 202416:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Defender Data Protect vulnerable to CVE-2024-45801 due to dependency on Open Source library.	11 Mar 202517:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by DOMPurify vulnerability (CVE-2024-45801)	22 Nov 202412:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to Inefficient Regular Expression Complexity in Grafana (CVE-2024-45801)	29 Jul 202521:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in DOMPurify	2 May 202507:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	15 Apr 202503:11	–	ibm

Vulners

Node

cure53 dompurifyRange1.0.1–2.5.3js

cure53 dompurifyRange3.0.0–3.1.2js

cure53 dompurifyRange1.0.1–2.5.3js

cure53 dompurifyRange1.0.5–1.0.7js

cure53 dompurifyRange1.0.7–2.3.3js

webjars dompurifyMatch0.6.2js

dompurify dompurifyRange1.0.1–2.5.3js

dompurify dompurifyRange3.0.0–3.1.2js

cure53 dompurifyRange1.0.4–2.5.3js

cure53 dompurifyRange3.0.1–3.1.2js

Source	Link
github	www.github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21
github	www.github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc
github	www.github.com/advisories/GHSA-mmhx-hmjr-r674
github	www.github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674

20 Sep 2024 14:24Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.3

EPSS0.00096

SSVC