Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1odjZtLXFqNjUtMjZxM84ABBCA

UnoPim Cross-site Scripting vulnerability

UnoPim 0.1.3 and below is vulnerable to Cross Site Scripting (XSS) in the Create User function.

The vulnerability allows attackers to perform XSS in SVG file extension, which can be used to stealing cookies.

Permalink: https://github.com/advisories/GHSA-hv6m-qj65-26q3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1odjZtLXFqNjUtMjZxM84ABBCA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 15 days ago
Updated: 15 days ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-hv6m-qj65-26q3, CVE-2024-50637
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-50637
• https://github.com/unopim/unopim/issues/41
• https://github.com/unopim/unopim/releases/tag/v0.1.4
• https://github.com/yamerooo123/ResearchNBugBountyEncyclopedia/blob/main/Researches/Unopim/Findings.md
• https://github.com/advisories/GHSA-hv6m-qj65-26q3

Repository: https://github.com/unopim/unopim
Blast Radius: 1.0

Affected Packages