Cross-Site Scripting in dojo
Affected versions of `dojo` are susceptible to a cross-site scripting vulnerability in the `dijit.Editor` and `textarea` components, which execute their contents as Javascript, even when sanitized. ## Recommendation Update to version 1.1.0 or later.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2008-6681US | medium4.3 | — | ||
Cross-site scripting (XSS) vulnerability in dijit.Editor in Dojo before 1.1 allows remote attackers to inject arbitrary web script or HTML via XML entities in a TEXTAREA element. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://trac.dojotoolkit.org/changeset/15346WEB
- http://trac.dojotoolkit.org/ticket/2140WEB
- http://www.dojotoolkit.org/book/dojo-1-1-release-notesWEB
- http://www.securityfocus.com/bid/34661WEB
- https://bugs.dojotoolkit.org/ticket/2140WEB
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49883WEB
- https://nvd.nist.gov/vuln/detail/CVE-2008-6681ADVISORY
- https://www.npmjs.com/advisories/107WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan