Cross-Site Scripting (XSS)

2019-10-0102:34:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

72.1%

JSON

no-vnc is vulnerable to cross-site scripting (XSS). A remote attacker is able to inject arbitrary Javascript ito a victim’s browser via messages propagated to the status field such as the VNC server name.

CPENameOperatorVersion
no-vncle0.6.1
apache-commons-compresseq1.18__1.module_el8.0.0+30+832da3a1
python-werkzeugeq0.14.1__5.el8ost
m2cryptoeq0.35.2__5.epel8.playground
apache-commons-jxpatheq1.3__29.module_el8.0.0+30+832da3a1
python-ovsdbappeq0.17.0__0.20190923110620.74b52bb.el8ost
python-ovsdbappeq0.15.0__0.20190312195947.bc06517.el8ost
python-ovsdbappeq0.15.0__0.20191008180429.bc06517.el8ost
ansible-runnereq1.4.4__1.el8ar
ansible-runnereq1.3.4__2.el8

Name	Operator	Version
no-vnc	le	0.6.1
apache-commons-compress	eq	1.18__1.module_el8.0.0+30+832da3a1
python-werkzeug	eq	0.14.1__5.el8ost
m2crypto	eq	0.35.2__5.epel8.playground
apache-commons-jxpath	eq	1.3__29.module_el8.0.0+30+832da3a1
python-ovsdbapp	eq	0.17.0__0.20190923110620.74b52bb.el8ost
python-ovsdbapp	eq	0.15.0__0.20190312195947.bc06517.el8ost
python-ovsdbapp	eq	0.15.0__0.20191008180429.bc06517.el8ost
ansible-runner	eq	1.4.4__1.el8ar
ansible-runner	eq	1.3.4__2.el8