Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript code execution. This attack appear to be exploitable via Attacker gains full javascript access to pages with Pym.js embeds when user visits an attacker crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
NPR Visuals Team Pym.js 跨站请求伪造漏洞
Vulnerability Description
NPR Visuals Team Pym.js是一个用于在容器中嵌入代码的工具。 NPR Visuals Team Pym.js 0.4.2版本至1.3.1版本中的‘Pym.js _onNavigateToMessage’函数的https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573存在跨站请求伪造漏洞。远程攻击者可利用该漏洞执行任意的JavaScript代码。
CVSS Information
N/A
Vulnerability Type
N/A