Baremetrics date range picker vulnerable to Cross-site Scripting

Description

The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are prone to cross-site scripting (XSS) when handling untrusted placeholder entries.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.14

References

• GHSA-465f-mxxh-grc4
• CVE-2021-32859
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @claviska/jquery-minicolors vulnerable to Cross-site Scripting - CVE-2021-32850
• Docsify vulnerable to cross-site scripting due to mishandled encoding - CVE-2021-30074
• ckeditor4 vulnerable to cross-site scripting - CVE-2021-33829
• Joplin vulnerable to Cross-site Scripting in notes - CVE-2021-37916

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

baremetrics-calendar