Erik Krogh Kristensen

The issue concerns a whitelist-oriented HTML sanitizer that contains one or more regular expressions vulnerable to Regular Expression Denial of Service (ReDoS). No known patches are available as of the time of publication.

The issue concerns a Regular Expression Denial of Service (ReDoS) vulnerability in the Useragent user agent parser for Node.js. This vulnerability affects all versions as of the time of publication. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue concerns Regular Expression Denial of Service (ReDoS) due to vulnerable regular expressions in Validate.js. As of the time of publication, it is unknown if any patches are available.

The issue concerns Regular Expression Denial of Service (ReDoS) due to one or more vulnerable regular expressions.

Validate.js provides a declarative way of validating javascript objects. The issue concerns one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). No known patches are available as of the time of publication.

The issue concerns a Regular Expression Denial of Service (ReDoS) in the HTML2Markdown Javascript implementation, which is used for converting HTML to Markdown text. No known patches are available as of the time of publication.

The issue concerns a Regular Expression Denial of Service (ReDoS) in the Knwl.js library, which is used for parsing text to extract information such as dates, times, phone numbers, and more. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue concerns Regular Expression Denial of Service (ReDoS) due to vulnerable regular expressions in CommonRegexJS. No known patches are available as of the time of publication.

The issue concerns Regular Expression Denial of Service (ReDoS) due to one or more vulnerable regular expressions in the framework. There is no information available about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The discordrb library, an implementation of the Discord API using Ruby, has a command injection issue due to the unsafe construction of a shell string using the file parameter in the encoder.rb file. This can potentially leave clients of discordrb vulnerable to command injection if user input is passed to the vulnerable method. An attacker can execute arbitrary shell commands on the host machine, with the full impact depending on the permissions of the process running the discordrb library.

The issue is related to cross-site scripting when handling untrusted menus in Mind-elixir, a free, open source mind map core.

The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors.

The issue is related to copy-paste cross-site scripting (XSS) in textAngular, a text editor for Angular.js. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor.

Vditor is a browser-side Markdown editor. The issue at hand is a copy-paste cross-site scripting (XSS) problem. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor.

The issue concerns a copy-paste cross-site scripting (XSS) flaw. This type of XSS requires the victim to be tricked into copying a malicious payload into the text editor.

Cockpit is a content management system that allows addition of content management functionality to any site. In the affected versions, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues.

The HTML sanitizer in esdoc-publish-html-plugin can be bypassed, potentially leading to cross-site scripting (XSS) issues. There are no known patches for this issue.

The issue is related to cross-site scripting (XSS) when handling untrusted `placeholder` entries. An attacker who can influence the `placeholder` field when creating a `Calendar` instance can supply arbitrary `html` or `javascript` that will be rendered in the context of a user, leading to XSS.

The issue arises when handling untrusted modal titles, allowing an attacker to influence the `title` field and supply arbitrary `html` or `javascript` code. This code will be rendered in the context of a user, potentially leading to cross-site scripting (XSS).

The issue concerns a CSS selector parser in MooTools that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack can occur if an attacker can inject a string into a CSS selector at runtime, a scenario that is quite common, for example, with jQuery CSS selectors.