CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23647 – Cross-site Scripting in Prism
https://notcve.org/view.php?id=CVE-2022-23647
Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. • https://github.com/PrismJS/prism/commit/e002e78c343154e1c0ddf9d6a0bb85689e1a5c7c https://github.com/PrismJS/prism/pull/3341 https://github.com/PrismJS/prism/security/advisories/GHSA-3949-f494-cm99 https://access.redhat.com/security/cve/CVE-2022-23647 https://bugzilla.redhat.com/show_bug.cgi?id=2056643 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3801 – Inefficient Regular Expression Complexity in prismjs/prism
https://notcve.org/view.php?id=CVE-2021-3801
prism is vulnerable to Inefficient Regular Expression Complexity prism es vulnerable a una Complejidad de Expresión Regular Ineficiente Insufficient Regular Expression Complexity in prismjs leads to a Regular Expression Denial of Service (ReDoS) attack. An unauthenticated attacker can exploit this flaw to cause an application to consume an excess amount of CPU by providing a crafted HTML comment as input. This can result in a denial of service attack. • https://github.com/prismjs/prism/commit/0ff371bb4775a131634f47d0fe85794c547232f9 https://huntr.dev/bounties/8c16ab31-6eb6-46d1-b9a4-387222fe1b8a https://access.redhat.com/security/cve/CVE-2021-3801 https://bugzilla.redhat.com/show_bug.cgi?id=2005445 • CWE-400: Uncontrolled Resource Consumption CWE-1333: Inefficient Regular Expression Complexity •
CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32723 – Regular Expression Denial of Service (ReDoS) in Prism
https://notcve.org/view.php?id=CVE-2021-32723
Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. • https://github.com/PrismJS/prism/pull/2688 https://github.com/PrismJS/prism/pull/2774 https://github.com/PrismJS/prism/security/advisories/GHSA-gj77-59wh-66hg https://www.oracle.com/security-alerts/cpujan2022.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 4CVE-2021-23341 – Regular Expression Denial of Service (ReDoS)
https://notcve.org/view.php?id=CVE-2021-23341
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components. El paquete prismjs versiones anteriores a 1.23.0, es vulnerable a la Denegación de Servicio de Expresión Regular (ReDoS) por medio de los componentes prism-asciidoc, prism-rest, prism-tap y prism-eiffel • https://github.com/PrismJS/prism/commit/c2f6a64426f44497a675cb32dccb079b3eff1609 https://github.com/PrismJS/prism/issues/2583 https://github.com/PrismJS/prism/pull/2584 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1076583 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076582 https://snyk.io/vuln/SNYK-JS-PRISMJS-1076581 •