0Xmoerror-22

**Name of the Vulnerable Software and Affected Versions** DOMSanitizer versions prior to 1.0.15 **Description** An incomplete input-validation defect exists in the `isDangerousUrl()` function, which is used to reject dangerous URL values in the `href` and `xlink:href` attributes. While the `javascript:` scheme is rejected, the `data:` scheme is only rejected if the literal substring `onload` is present. Since `data:` payloads are often Base64-encoded, malicious content such as scripts or event handlers can bypass this check, allowing active markup to persist in the attributes. **Recommendations** Update to version 1.0.15.

**Name of the Vulnerable Software and Affected Versions** InvoicePlane versions prior to 1.7.2 **Description** An authorization flaw exists where a secondary administrator can take over the primary administrator account. While a previous fix protected the `Users::change password()` function, the `Users::form()` function lacks equivalent object-level authorization checks when editing the primary administrator's account. Because the `user email` variable is not included in `PROTECTED FIELDS`, a secondary administrator can modify the primary administrator's email address. This allows the attacker to use the public password-recovery flow, which identifies accounts by `user email`, to receive a reset token and gain full control of the primary administrator account via the `users/change password/{id}` endpoint. **Recommendations** Update InvoicePlane to version 1.7.2 or later.

**Name of the Vulnerable Software and Affected Versions** InvoicePlane version 1.7.2 **Description** In the `Users::form()` function, the application fails to perform an object-level authorization check on the `user id` variable when it is set to 1. This allows a Secondary Administrator to change the Primary Administrator's `user type` to 2 (Guest / read-only), which removes the root account's privileges and locks the legitimate owner out of the instance. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.