tui-calendar-1.15.3.tgz: 5 vulnerabilities (highest severity is: 10.0) #4
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-for-jackfan.us.kg
bot
added
the
Mend: dependency security vulnerability
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/dompurify/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - dompurify-2.3.4.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-2.3.4.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/dompurify/package.json
Dependency Hierarchy:
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.
Publish Date: 2024-10-11
URL: CVE-2024-47875
CVSS 3 Score Details (10.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-47875
Release Date: 2024-10-11
Fix Resolution: dompurify - 2.5.0,3.1.3
Vulnerable Library - dompurify-2.3.4.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-2.3.4.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/dompurify/package.json
Dependency Hierarchy:
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2.
Publish Date: 2024-10-31
URL: CVE-2024-48910
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-p3vf-v8qc-cwcr
Release Date: 2024-10-31
Fix Resolution: DOMPurify - 2.4.2
Vulnerable Library - dompurify-2.3.4.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-2.3.4.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/dompurify/package.json
Dependency Hierarchy:
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check. This renders dompurify unable to avoid cross site scripting (XSS) attacks. This issue has been addressed in versions 2.5.4 and 3.1.3 of DOMPurify. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-09-16
URL: CVE-2024-45801
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-mmhx-hmjr-r674
Release Date: 2024-09-16
Fix Resolution: domPurify - 2.5.4,3.1.3
Vulnerable Library - dompurify-2.3.4.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-2.3.4.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/dompurify/package.json
Dependency Hierarchy:
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Insufficient checks in DOMPurify allows an attacker to bypass sanitizers and execute arbitrary JavaScript code. This issue affects versions before 2.5.8 and 3.x before 3.2.3.
Publish Date: 2024-02-08
URL: WS-2024-0017
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2024-02-08
Fix Resolution: domPurify - 2.5.8,3.2.3
Vulnerable Library - dompurify-2.3.4.tgz
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-2.3.4.tgz
Path to dependency file: /frontend/package.json
Path to vulnerable library: /frontend/node_modules/dompurify/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).
Publish Date: 2025-02-14
URL: CVE-2025-26791
CVSS 3 Score Details (4.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2025-26791
Release Date: 2025-02-14
Fix Resolution: dompurify - 3.2.4
The text was updated successfully, but these errors were encountered: