Erik Krogh Kristensen

**Name of the Vulnerable Software and Affected Versions** insane versions 2.6.2 and prior **Description** The issue concerns a whitelist-oriented HTML sanitizer that contains one or more regular expressions vulnerable to Regular Expression Denial of Service (ReDoS). No known patches are available as of the time of publication. **Recommendations** For versions 2.6.2 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Useragent versions prior to a fixed version (no fixed version specified) **Description** The issue concerns a Regular Expression Denial of Service (ReDoS) vulnerability in the Useragent user agent parser for Node.js. This vulnerability affects all versions as of the time of publication. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Validate.js versions prior to the version released after 30 November 2020 **Description** The issue concerns Regular Expression Denial of Service (ReDoS) due to vulnerable regular expressions in Validate.js. As of the time of publication, it is unknown if any patches are available. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Validate.js versions 0.11.3 and prior Nope versions 0.11.3 and prior **Description** The issue concerns Regular Expression Denial of Service (ReDoS) due to one or more vulnerable regular expressions. **Recommendations** For Validate.js versions 0.11.3 and prior: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Nope versions 0.11.3 and prior: Update to version 0.12.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Validate.js versions 0.13.1 and prior **Description** Validate.js provides a declarative way of validating javascript objects. The issue concerns one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). No known patches are available as of the time of publication. **Recommendations** For versions 0.13.1 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HTML2Markdown versions all available versions **Description** The issue concerns a Regular Expression Denial of Service (ReDoS) in the HTML2Markdown Javascript implementation, which is used for converting HTML to Markdown text. No known patches are available as of the time of publication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Knwl.js versions 1.0.2 and prior **Description** The issue concerns a Regular Expression Denial of Service (ReDoS) in the Knwl.js library, which is used for parsing text to extract information such as dates, times, phone numbers, and more. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For versions 1.0.2 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CommonRegexJS versions all available versions **Description** The issue concerns Regular Expression Denial of Service (ReDoS) due to vulnerable regular expressions in CommonRegexJS. No known patches are available as of the time of publication. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foundation versions 6.3.3 and prior **Description** The issue concerns Regular Expression Denial of Service (ReDoS) due to one or more vulnerable regular expressions in the framework. There is no information available about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For Foundation versions 6.3.3 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** discordrb versions prior to commit 91e13043ffa **Description** The discordrb library, an implementation of the Discord API using Ruby, has a command injection issue due to the unsafe construction of a shell string using the file parameter in the encoder.rb file. This can potentially leave clients of discordrb vulnerable to command injection if user input is passed to the vulnerable method. An attacker can execute arbitrary shell commands on the host machine, with the full impact depending on the permissions of the process running the discordrb library. **Recommendations** For discordrb versions prior to commit 91e13043ffa, update the library to a version that includes the fix for this issue, once it is available. As a temporary workaround, consider restricting the use of the vulnerable method to minimize the risk of exploitation. Avoid passing user input to the vulnerable method in the encoder.rb file until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Mind-elixir versions prior to 0.18.1 **Description** The issue is related to cross-site scripting when handling untrusted menus in Mind-elixir, a free, open source mind map core. **Recommendations** For versions prior to 0.18.1, update to version 0.18.1 to resolve the issue. As a temporary workaround, consider restricting the handling of untrusted menus until the update is applied.

**Name of the Vulnerable Software and Affected Versions** jQuery MiniColors versions prior to 2.3.6 **Description** The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors. **Recommendations** For versions prior to 2.3.6, update to version 2.3.6 to resolve the issue. As a temporary workaround, consider validating and sanitizing color names to prevent cross-site scripting attacks.

**Name of the Vulnerable Software and Affected Versions** textAngular versions 1.5.16 and prior **Description** The issue is related to copy-paste cross-site scripting (XSS) in textAngular, a text editor for Angular.js. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. **Recommendations** For versions 1.5.16 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vditor versions prior to 3.8.7 **Description** Vditor is a browser-side Markdown editor. The issue at hand is a copy-paste cross-site scripting (XSS) problem. For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. **Recommendations** For versions prior to 3.8.7, update to version 3.8.7 to resolve the issue. As a temporary workaround, consider restricting the use of the text editor until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** Microweber versions 1.2.12 and prior **Description** The issue concerns a copy-paste cross-site scripting (XSS) flaw. This type of XSS requires the victim to be tricked into copying a malicious payload into the text editor. **Recommendations** For versions 1.2.12 and prior, update to a version that includes a complete fix for the copy-paste XSS issue, as the fixes attempted in versions 1.2.9 and 1.2.12 are incomplete. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cockpit versions 0.12.2 and prior **Description** Cockpit is a content management system that allows addition of content management functionality to any site. In the affected versions, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. **Recommendations** For Cockpit versions 0.12.2 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the `htmleditor.js` function until a patch is available. Restrict access to the `htmleditor.js` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** esdoc-publish-html-plugin versions 1.1.2 and prior **Description** The HTML sanitizer in esdoc-publish-html-plugin can be bypassed, potentially leading to cross-site scripting (XSS) issues. There are no known patches for this issue. **Recommendations** For esdoc-publish-html-plugin versions 1.1.2 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Baremetrics date range picker versions 1.0.14 and prior **Description** The issue is related to cross-site scripting (XSS) when handling untrusted `placeholder` entries. An attacker who can influence the `placeholder` field when creating a `Calendar` instance can supply arbitrary `html` or `javascript` that will be rendered in the context of a user, leading to XSS. **Recommendations** For versions 1.0.14 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iziModal versions prior to 1.6.1 **Description** The issue arises when handling untrusted modal titles, allowing an attacker to influence the `title` field and supply arbitrary `html` or `javascript` code. This code will be rendered in the context of a user, potentially leading to cross-site scripting (XSS). **Recommendations** For versions prior to 1.6.1, update to version 1.6.1 to resolve the issue. As a temporary workaround, consider restricting the ability to influence the `title` field when creating an `iziModal` instance to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MooTools versions all known versions **Description** The issue concerns a CSS selector parser in MooTools that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack can occur if an attacker can inject a string into a CSS selector at runtime, a scenario that is quite common, for example, with jQuery CSS selectors. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.