ids-enterprise 4.15.0-dev.20190125 vulnerabilities

Known vulnerabilities in the ids-enterprise package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
M Cross-site Scripting (XSS) ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Script tags inside dropdown options are executed when removing search text using backspace, resulting in execution of JavaScript. How to fix Cross-site Scripting (XSS)? Upgrade `ids-enterprise` to version 4.23.0-dev.20191105 or higher.	<4.23.0-dev.20191105
M Cross-site Scripting (XSS) ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The title and title example value of a modal was found to be unescaped, allowing insertion of JavaScript which is not sanitized. How to fix Cross-site Scripting (XSS)? Upgrade `ids-enterprise` to version 4.22.0-beta.0 or higher.	<4.22.0-beta.0
M Cross-site Scripting (XSS) ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript. How to fix Cross-site Scripting (XSS)? Upgrade `ids-enterprise` to version 4.18.2 or higher.	<4.18.2
M Cross-site Scripting (XSS) ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript. How to fix Cross-site Scripting (XSS)? Upgrade `ids-enterprise` to version 4.18.2 or higher.	<4.18.2
M Cross-site Scripting (XSS) ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). JavaScript inserted within `soho-autocomplete` and `soho-dropdown` attributes are returned without proper output encoding resulting in XSS. How to fix Cross-site Scripting (XSS)? Upgrade `ids-enterprise` to version 4.18.2 or higher.	<4.18.2
H Cross-site Scripting (XSS) ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the "add tab" api, because it treats the name as html. How to fix Cross-site Scripting (XSS)? Upgrade `ids-enterprise` to version 4.15.0 or higher.	<4.15.0

Vulnerability

Vulnerable Version

Cross-site Scripting (XSS)

ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Script tags inside dropdown options are executed when removing search text using backspace, resulting in execution of JavaScript.