ids-enterprise@4.17.0-rc.0.20190327 vulnerabilities

ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Script tags inside dropdown options are executed when removing search text using backspace, resulting in execution of JavaScript.

Upgrade ids-enterprise to version 4.23.0-dev.20191105 or higher.

ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The title and title example value of a modal was found to be unescaped, allowing insertion of JavaScript which is not sanitized.

Upgrade ids-enterprise to version 4.22.0-beta.0 or higher.

ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The soho-dropdown component does not properly encode its output and may allow attackers to execute arbitrary JavaScript.

Upgrade ids-enterprise to version 4.18.2 or higher.

ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The modal component fails to sanitize input to the title attribute, which may allow attackers to execute arbitrary JavaScript.

Upgrade ids-enterprise to version 4.18.2 or higher.

ids-enterprise is a framework-independent UI library consisting of CSS and JS that provides product development teams, partners, and customers the tools to create user experiences that are approachable, focused, relevant, perceptive.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). JavaScript inserted within soho-autocomplete and soho-dropdown attributes are returned without proper output encoding resulting in XSS.

Upgrade ids-enterprise to version 4.18.2 or higher.