Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Reflected XSS when using flashMessages
Vulnerability Description
auth0-lock is Auth0's signin solution. Versions of nauth0-lock before and including `11.30.0` are vulnerable to reflected XSS. An attacker can execute arbitrary code when the library's `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage` or the library's `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`. The vulnerability is patched in version 11.30.1.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
Auth0 跨站脚本漏洞
Vulnerability Description
Auth0是是一个身份验证代理，支持社会和企业身份提供者，包括Active Directory、LDAP、谷歌Apps和Salesforce。 auth0-lock在11.30.0版本存在跨站脚本漏洞，该漏洞源于攻击者可利用该漏洞可以执行任意代码库跨站脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A