漏洞信息
尽管我们使用了先进的大模型技术,但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性,但请您根据实际情况进行核实和判断。
Vulnerability Title
Vega allows Cross-site Scripting via the vlSelectionTuples function
Vulnerability Description
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the `vlSelectionTuples` function can be used to call JavaScript functions, leading to cross-site scripting.`vlSelectionTuples` calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument. This can be used to call `Function()` with arbitrary JavaScript and the resulting function can be called with `vlSelectionTuples` or using a type coercion to call `toString` or `valueOf`. Version 5.26.0 of vega and 5.4.2 of vega-selections fix this issue.
CVSS Information
N/A
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
Vega 跨站脚本漏洞
Vulnerability Description
Vega是Vega团队的一个基于Javscript可用来创建交互式可视化展示的软件。该软件可使用JSON格式描述数据可视化,并使用HTML5 Canvas或SVG生成交互式视图。 Vega存在跨站脚本漏洞,该漏洞源于vlSelectionTuples调用多个可由攻击者控制的函数,包括一个带有攻击者控制的参数调用,从而导致跨站点脚本攻击。
CVSS Information
N/A
Vulnerability Type
N/A