Lucene search
AnonymousNODEJS:1591HistoryDec 18, 2020 - 10:54 p.m.
Cross-Site Scripting
2020-12-1822:54:16
Anonymous
www.npmjs.com
56
cure53 dompurify
2.0.17
mutation xss
fix
serialize-parse
namespace change
html
mathml
form elements
upgrade
reference
github advisory
EPSS
0.01
Percentile
83.7%
Overview
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
Recommendation
Upgrade to version 2.0.17 or later.
References
Related
osv
osv
CVE-2020-26870
2020-10-07 16:15:18
Cross-site Scripting in dompurify
2020-12-18 22:51:40
Server side request forgery in SwaggerUI
2021-12-09 19:08:38
debiancve
debiancve
CVE-2020-26870
2020-10-07 16:15:00
CVE-2021-38193
2021-08-08 06:15:09
veracode
veracode
Cross-Site Scripting (XSS)
2020-10-08 06:06:52
cve
cve
nvd
nvd
cvelist
cvelist
ubuntucve
ubuntucve
CVE-2020-26870
2020-10-07 00:00:00
CVE-2021-38193
2021-08-08 00:00:00
mscve
mscve
Visual Studio Remote Code Execution Vulnerability
2021-01-12 08:00:00
github
github
Cross-site Scripting in dompurify
2020-12-18 22:51:40
Reflected XSS in Gotify's /docs via import of outdated Swagger UI
2023-01-10 22:48:43
Server side request forgery in SwaggerUI
2021-12-09 19:08:38
prion
prion
Session fixation
2020-10-07 16:15:00
Design/Logic Flaw
2021-08-08 06:15:00
Design/Logic Flaw
2020-10-16 05:15:00
openvas
openvas
Debian: Security Advisory (DLA-2419-1)
2020-10-30 00:00:00
debian
debian
[SECURITY] [DLA 2419-1] dompurify.js security update
2020-10-29 16:03:08
nessus
nessus
Debian DLA-2419-1 : dompurify.js security update
2020-10-30 00:00:00
Security Updates for Microsoft Visual Studio Products (January 2021)
2021-01-14 00:00:00
Dell Wyse Management Suite < 4.0 Multiple Vulnerabilities (DSA-2022-329)
2022-12-19 00:00:00
ibm
ibm
kaspersky
kaspersky
KLA12040 Multiple vulnerability in Microsoft Developer Tools
2021-01-12 00:00:00
rapid7blog
rapid7blog
Patch Tuesday - January 2021
2021-01-12 23:59:00
oracle
oracle
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00
Oracle Critical Patch Update Advisory - July 2021
2021-07-20 00:00:00