https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 08:47:51 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-28471 cnvd-2020-28471 https://cve.radiocsirt.org/vuln/cnvd-2020-28471 https://cve.radiocsirt.org/vuln/euvd-2026-40688 EUVD-2026-40688 https://cve.radiocsirt.org/vuln/euvd-2026-40688 https://cve.radiocsirt.org/vuln/fkie_cve-2020-11610 <p>An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the &#34;magical iframe&#34; and receive the messages that the &#34;magical iframe&#34; sends.</p> <p>An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the &#34;magical iframe&#34; and receive the messages that the &#34;magical iframe&#34; sends.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-11610 https://cve.radiocsirt.org/vuln/ghsa-mr5m-2385-2vcp <p><strong>Affected:</strong> npm: xdlocalstorage</p> <p>An issue was discovered in xdLocalStorage through 2.0.5. The `postData()` function in `xdLocalStoragePostMessageApi.js` specifies the wildcard (`*`) as the targetOrigin when calling the `postMessage()` function on the parent object. Therefore any domain can load the application hosting the &#34;magical iframe&#34; and receive the messages that the &#34;magical iframe&#34; sends.</p> <p><strong>Affected:</strong> npm: xdlocalstorage</p> <p>An issue was discovered in xdLocalStorage through 2.0.5. The `postData()` function in `xdLocalStoragePostMessageApi.js` specifies the wildcard (`*`) as the targetOrigin when calling the `postMessage()` function on the parent object. Therefore any domain can load the application hosting the &#34;magical iframe&#34; and receive the messages that the &#34;magical iframe&#34; sends.</p> https://cve.radiocsirt.org/vuln/ghsa-mr5m-2385-2vcp https://cve.radiocsirt.org/vuln/gsd-2020-11610 gsd-2020-11610 https://cve.radiocsirt.org/vuln/gsd-2020-11610