Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2020-7750

Cross-site Scripting (XSS)

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.

CVSS 3.1 · 9.6 Critical EPSS 6.1% KEV · Not listed
Vendors
Mit
Products
Scratch-svg-renderer
CVE-2020-27428

A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mit
Products
Scratch-svg-renderer