Vulnerabilities

TI-2022-19195 CVE-2022-40440 · GHSA-j4rv-pr9g-q8jv

mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.

LOW 28

mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00713 Published 2022-10-11 No fix listed CWE-79

TI-2019-09832 CVE-2019-13127 · GHSA-xm59-jvxm-cp3v

An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams"…

LOW 30

An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams" plugin before 8.3.14 for Confluence and other products.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01503 Published 2019-07-01 Fixed in 4.0.1 CWE-20

TI-2017-13382 CVE-2017-18197 · GHSA-wvpv-8524-wg6x

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in…

MEDIUM 47

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02899 Published 2018-02-24 Partial fix · 3.7.6 CWE-611

Vulnerabilities

Filters

mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.

An issue was discovered in mxGraph through 4.0.0, related to the "draw.io Diagrams"…

In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in…