Nixpkgs security tracker
6.4 MEDIUM
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): Low (L)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): Low (L)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
by @LeSuisse Activity log
- Created suggestion
- @LeSuisse dismissed (not in Nixpkgs)
Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute
The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Affected products
- =<2.5.2
Matching in nixpkgs
pkgs.fgqcanvas
Qt-based remote canvas application for FlightGear
-
nixos-unstable 0-unstable-2024-02-11
- nixpkgs-unstable 0-unstable-2024-02-11
- nixos-unstable-small 0-unstable-2024-02-11
-
nixos-26.05 0-unstable-2024-02-11
- nixos-26.05-small 0-unstable-2024-02-11
- nixpkgs-26.05-darwin 0-unstable-2024-02-11
pkgs.goocanvas
Canvas widget for GTK based on the the Cairo 2D library
pkgs.goocanvas2
Canvas widget for GTK based on the the Cairo 2D library
pkgs.goocanvas3
Canvas widget for GTK based on the the Cairo 2D library
pkgs.goocanvas_1
Canvas widget for GTK based on the the Cairo 2D library
pkgs.goocanvas_2
Canvas widget for GTK based on the the Cairo 2D library
pkgs.goocanvas_3
Canvas widget for GTK based on the the Cairo 2D library
pkgs.goocanvasmm2
C++ bindings for GooCanvas
pkgs.idrisPackages.canvas
Idris FFI binding for html5 canvas 2d api
-
nixos-unstable 2017-11-09
- nixpkgs-unstable 2017-11-09
- nixos-unstable-small 2017-11-09
-
nixos-26.05 2017-11-09
- nixos-26.05-small 2017-11-09
- nixpkgs-26.05-darwin 2017-11-09
pkgs.gnome2.libgnomecanvas
None
pkgs.perlPackages.GooCanvas
Perl interface to the GooCanvas
pkgs.perl5Packages.GooCanvas
Perl interface to the GooCanvas
pkgs.perlPackages.GooCanvas2
Perl binding for GooCanvas2 widget using Glib::Object::Introspection
pkgs.perlPackages.WxGLCanvas
wxPerl demo helper for Wx::GLCanvas
pkgs.perl5Packages.GooCanvas2
Perl binding for GooCanvas2 widget using Glib::Object::Introspection
pkgs.perl5Packages.WxGLCanvas
wxPerl demo helper for Wx::GLCanvas
pkgs.python313Packages.ipycanvas
Expose the browser's Canvas API to IPython
pkgs.python314Packages.ipycanvas
Expose the browser's Canvas API to IPython
pkgs.haskellPackages.blank-canvas
HTML5 Canvas Graphics Library
pkgs.haskellPackages.yampa-canvas
blank-canvas frontend for Yampa
pkgs.python313Packages.rendercanvas
One canvas API, multiple backends
pkgs.python314Packages.rendercanvas
One canvas API, multiple backends
pkgs.haskellPackages.diagrams-canvas
HTML5 canvas backend for diagrams drawing EDSL
pkgs.perlPackages.GooCanvas2CairoTypes
Bridge between GooCanvas2 and Cairo types
pkgs.perl5Packages.GooCanvas2CairoTypes
Bridge between GooCanvas2 and Cairo types
Package maintainers
-
@bobby285271 Bobby Rong <rjl931189261@126.com>
-
@Pandapip1 Gavin John <gavinnjohn@gmail.com>
-
@brainrake Marton Boros <martonboros@gmail.com>
-
@jonhermansen Jon Hermansen <jon@jh86.org>
-
@flexiondotorg Martin Wimpress <martin@wimpress.org>
-
@bcdarwin Ben Darwin <bcdarwin@gmail.com>
-
@bengsparks Ben Sparks <benjamin.sparks@protonmail.com>