Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross site scripting vulnerability in ScratchTools
Vulnerability Description
ScratchTools is a web extension designed to make interacting with the Scratch programming language community (Scratching) easier. In affected versions anybody who uses the Recently Viewed Projects feature is vulnerable to having their account taken over if they view a project that tries to. The issue is that if a user visits a project that includes Javascript in the title, then when the Recently Viewed Projects feature displays it, it could run the Javascript. This issue has been addressed in the 2.5.2 release. Users having issues scratching should open an issue in the project issue tracker https://github.com/STForScratch/ScratchTools/
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
ScratchTools 跨站脚本漏洞
Vulnerability Description
ScratchTools是STForScratch开源的一个 Web 扩展。旨在使与 Scratch 编程语言社区 (Scratching) 的交互更加容易。 ScratchTools存在跨站脚本漏洞，该漏洞源于如果用户访问标题中包含 Javascript 的项目，那么当Recently Viewed Projects功能显示它时，会运行 Javascript 代码。
CVSS Information
N/A
Vulnerability Type
N/A