https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 05:50:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-42660 EUVD-2026-42660 https://cve.radiocsirt.org/vuln/euvd-2026-42660 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15119 <p>In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.</p> <p>In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-15119 https://cve.radiocsirt.org/vuln/ghsa-6gg3-pmm7-97xc <p><strong>Affected:</strong> npm: auth0-lock</p> <p>### Overview Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.</p> <p>- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. - For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.</p> <p>When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.</p> <p>### Am I affected? You are affected by this vulnerability if all of the following conditions apply:</p> <p>- You are using auth0-lock - You are using Passwordless or Enterprise connection mode</p> <p>### How to fix that? Upgrade to version `11.26.3`</p> <p>### Will this update impact my users? The fix provided in patch will not affect your users.</p> <p>### Credit https://github.com/mvisat</p> <p><strong>Affected:</strong> npm: auth0-lock</p> <p>### Overview Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.</p> <p>- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input. - For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.</p> <p>When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.</p> <p>### Am I affected? You are affected by this vulnerability if all of the following conditions apply:</p> <p>- You are using auth0-lock - You are using Passwordless or Enterprise connection mode</p> <p>### How to fix that? Upgrade to version `11.26.3`</p> <p>### Will this update impact my users? The fix provided in patch will not affect your users.</p> <p>### Credit https://github.com/mvisat</p> https://cve.radiocsirt.org/vuln/ghsa-6gg3-pmm7-97xc https://cve.radiocsirt.org/vuln/gsd-2020-15119 gsd-2020-15119 https://cve.radiocsirt.org/vuln/gsd-2020-15119