Framework Cross-site Scripting

Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13. (2022-12-12, CVE-2022-4414)

Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. (2022-12-12, CVE-2022-4413)

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). (2022-11-23, CVE-2022-38147)

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters. (2022-11-23, CVE-2022-37429)

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view. (2022-11-23, CVE-2022-38145)

Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2). (2022-11-23, CVE-2022-37430)

Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS. (2022-11-23, CVE-2022-38724)

Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request. (2022-11-22, CVE-2022-38462)

Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3). (2022-11-21, CVE-2022-38146)

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitise_server_side contig is not set to true in project code. (2022-06-28, CVE-2022-25238)

Adive Framework 2.0.8 has admin/user/add userName XSS. (2020-01-26, CVE-2020-7990)

Adive Framework 2.0.8 has admin/user/add userUsername XSS. (2020-01-26, CVE-2020-7989)

Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions. (2019-08-13, CVE-2019-14987)

Cross site scripting is an attack where a web page executes code that is injected by an adversary. It usually appears, when users input is presented. This attack can be used to impersonate a user, take over control of the session, or even steal API keys.

The attack can be executed e.g. when you application injects the request parameter directly into the HTML code of the page returned to the user:

https://server.com/confirmation?message=Transaction+Complete

what results in:

<span>Confirmation: Transaction Complete</span>

In that case the message can be modified to become a valid Javascript code, e.g.:

https://server.com/confirmation?message=<script>dangerous javascript code here</script>

and it will be executed locally by the user's browser with full access to the user's personal application/browser data:

<span>Confirmation: <script>dangerous javascript code here</script></span>