Most recent entries from all

cnvd-2019-34721

EUVD-2026-80357

fkie_cve-2017-18635

An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

GHSA-49rv-g7w5-m8xx — Cross-Site Scripting in @novnc/novnc

Affected: npm: @novnc/novnc

Versions of `@novnc/novnc` prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of `include/ui.js` and users of `vnc_auto.html` and `vnc.html`.

## Recommendation

Upgrade to version 0.6.2 or later.

gsd-2017-18635

RHSA-2020:0754 — Red Hat Security Advisory: novnc security update

novnc: XSS vulnerability via the messages propagated to the status field

UBUNTU-CVE-2017-18635

Affected: Ubuntu:16.04:LTS: novnc, Ubuntu:18.04:LTS: novnc