Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-V5HP-35HW-CW5X

    Vulnerability from github – Published: 2020-09-01 15:33 – Updated: 2021-09-23 21:32
    VLAI
    Summary
    XSS in client rendered block templates in rendr
    Details

    Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a _block.

    Server side rendering is not affected and is properly escaped.

    Recommendation

    Update to version 1.1.4 or later.

    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.1.3"
      },
      "package": {
        "ecosystem": "npm",
        "name": "rendr"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-1000230"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:11:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Affected versions of `rendr` are vulnerable to cross-site scripting when client side rendering is done inside a `_block`.\n\nServer side rendering is not affected and is properly escaped.\n\n\n## Recommendation\n\nUpdate to version 1.1.4 or later.",
  "id": "GHSA-v5hp-35hw-cw5x",
  "modified": "2021-09-23T21:32:40Z",
  "published": "2020-09-01T15:33:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000230"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rendrjs/rendr-handlebars/pull/61"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rendrjs/rendr/pull/513"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rendrjs/rendr-handlebars"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/128"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "XSS in client rendered block templates in rendr"
}

    GSD-2016-1000230

    Vulnerability from gsd - Updated: 2023-12-13 01:21
    Details
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
    Aliases
    Aliases
    CVE-2016-1000230
    To clipboard 

    {
  "GSD": {
    "alias": "CVE-2016-1000230",
    "id": "GSD-2016-1000230"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-1000230"
      ],
      "id": "GSD-2016-1000230",
      "modified": "2023-12-13T01:21:18.115063Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2016-1000230",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c=1.1.3",
          "affected_versions": "All versions up to 1.1.3",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2021-09-23",
          "description": "Affected versions of `rendr` are vulnerable to cross-site scripting when client side rendering is done inside a `_block`.\n\nServer side rendering is not affected and is properly escaped.\n\n\n## Recommendation\n\nUpdate to version 1.1.4 or later.",
          "fixed_versions": [
            "1.1.4"
          ],
          "identifier": "GMS-2020-765",
          "identifiers": [
            "GHSA-v5hp-35hw-cw5x",
            "GMS-2020-765",
            "CVE-2016-1000230"
          ],
          "not_impacted": "All versions after 1.1.3",
          "package_slug": "npm/rendr",
          "pubdate": "2020-09-01",
          "solution": "Upgrade to version 1.1.4 or above.",
          "title": "XSS in client rendered block templates in rendr",
          "urls": [
            "https://github.com/rendrjs/rendr-handlebars/pull/61",
            "https://github.com/rendrjs/rendr/pull/513",
            "https://www.npmjs.com/advisories/128",
            "https://nvd.nist.gov/vuln/detail/CVE-2016-1000230",
            "https://github.com/advisories/GHSA-v5hp-35hw-cw5x"
          ],
          "uuid": "c46c5355-7d6e-4285-bc14-1a9806546467"
        }
      ]
    }
  }
}