CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2022-3095 – Incorrect parsing of the backslash characters in Dart library
https://notcve.org/view.php?id=CVE-2022-3095
27 Oct 2022 — The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue. La implementación del análisis de barra invertida en la clase Dart URI para versiones anteriores a 2.18 y versiones de Flutter anter... • https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-0451 – Auth bypass in Dark SDK
https://notcve.org/view.php?id=CVE-2022-0451
18 Feb 2022 — Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond. • https://dart-review.googlesource.com/c/sdk/+/229947 • CWE-305: Authentication Bypass by Primary Weakness CWE-863: Incorrect Authorization •
CVSS: 4.6EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22567 – Bidirectional Override in Dart SDK
https://notcve.org/view.php?id=CVE-2021-22567
05 Jan 2022 — Bidirectional Unicode text can be interpreted and compiled differently than how it appears in editors which can be exploited to get nefarious code passed a code review by appearing benign. An attacker could embed a source that is invisible to a code reviewer that modifies the behavior of a program in unexpected ways. El texto Unicode bidireccional puede ser interpretado y compilado de forma diferente a como aparece en los editores, lo que puede ser explotado para conseguir que el código nefasto pase una rev... • https://github.com/dart-lang/sdk/blob/main/CHANGELOG.md • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22568 – Dart - Publishing to third-party package repositories may expose pub.dev credentials
https://notcve.org/view.php?id=CVE-2021-22568
09 Dec 2021 — When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token that is valid for publishing on pub.dev. Using these obtained credentials, an attacker can impersonate the user on pub.dev. We recommend upgrading past https://github.com/dart-lang/sdk/commit/d787e78d21e12ec1ef712d229940b1172aafcdf8 or beyond version 2.15.0 Cuando es usado el comando dart pub publish para publicar un paquete en un servidor de paquetes d... • https://github.com/dart-lang/sdk/blob/main/CHANGELOG.md • CWE-255: Credentials Management Errors CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-22540 – XSS in Dart SDK
https://notcve.org/view.php?id=CVE-2021-22540
22 Apr 2021 — Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags. Una mala lógica de comprobación en el Dart SDK versiones anteriores a 2.12.3 permite a un atacante usar un ataque de tipo XSS por medio de DOM clobbering. La lógica de comprobación en dart: html para crear nodos DOM a partir de texto no se saneaban apropiada... • https://github.com/dart-lang/sdk/commit/ce5a1c2392debce967415d4c09359ff2555e3588 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2020-8923 – XSS in Dart
https://notcve.org/view.php?id=CVE-2020-8923
26 Mar 2020 — An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the dev version. If you cannot update, we recommend you review the way you use the affected APIs, and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerT... • https://github.com/dart-lang/sdk/security/advisories/GHSA-hfq3-v9pv-p627 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •