Skip to content

Commit 064bac1

Browse files
authored
Merge commit from fork
security: Fix XSS in Vulnerability Page
2 parents 7e617c1 + 70b8f29 commit 064bac1

4 files changed

Lines changed: 19 additions & 0 deletions

File tree

.github/SECURITY.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ Thanks to these individuals for reporting Security Issues in reNgine.
4040
### 2024
4141

4242
* [HIGH] [Command Injection](https://github.com/yogeshojha/rengine/security/advisories/GHSA-fx7f-f735-vgh4) in Waf Detector, Reported by [n-thumann](https://github.com/n-thumann)
43+
* [MEDIUM] [Stored XSS](https://github.com/yogeshojha/rengine/security/advisories/GHSA-96q4-fj2m-jqf7) in in Vulnerability Page, Reported by [Touhid M Shaikh](https://github.com/touhidshaikh)
4344

4445
### 2022
4546

web/startScan/templates/startScan/detail_scan.html

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1745,6 +1745,12 @@ <h4 class="header-title mb-0"><span id="endpoint_change_count"><span class="spin
17451745
},
17461746
"targets": 16,
17471747
},
1748+
{
1749+
"render": function ( data, type, row ) {
1750+
return htmlEncode(data);
1751+
},
1752+
"targets": 17,
1753+
}
17481754
],
17491755
"initComplete": function(settings, json) {
17501756
api = this.api();

web/startScan/templates/startScan/vulnerabilities.html

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,12 @@
234234
},
235235
"targets": 16,
236236
},
237+
{
238+
"render": function ( data, type, row ) {
239+
return htmlEncode(data);
240+
},
241+
"targets": 17,
242+
}
237243
],
238244
"initComplete": function(settings, json) {
239245
api = this.api();

web/targetApp/templates/target/summary.html

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1545,6 +1545,12 @@ <h4 class="header-title mb-0"><span id="technologies-count"><span class="spinner
15451545
},
15461546
"targets": 16,
15471547
},
1548+
{
1549+
"render": function ( data, type, row ) {
1550+
return htmlEncode(data);
1551+
},
1552+
"targets": 17,
1553+
}
15481554
],
15491555
"initComplete": function(settings, json) {
15501556
api = this.api();

0 commit comments

Comments
 (0)