Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Fava before 1.22.3 is vulnerable to reflected cross-site scripting due to improper validation on filter conversion.
Recommended action: Upgrade to 1.22.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected cross-site scripting due to the lack of escaping of error messages which contained the parameters in verbatim.
Recommended action: Upgrade to 1.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2. The querystring parameter of Fava is vulnerable to reflected cross-site scripting, for which a attacker can modify any information that the user is able to modify. This issue is fixed in version 1.22.2.
Recommended action: Upgrade to 1.22.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.