CVE-2018-19289
published 2018-11-15CVE-2018-19289: An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.23%
65.1th percentile
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| valine.js | valine | — | — |
| valine.js | valine | >= 0 < 1.3.4 | 1.3.4 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Valine HTML Injection
osv·2018-11-21
CVE-2018-19289 [MEDIUM] Valine HTML Injection
Valine HTML Injection
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
GHSA
Valine HTML Injection
ghsa·2018-11-21
CVE-2018-19289 [MEDIUM] CWE-79 Valine HTML Injection
Valine HTML Injection
An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-11-15
Published