Cross Domain Local Storage
Approved changes feed: RSS · Atom
cpe:2.3:a:cross_domain_local_storage_project:cross_domain_local_storage:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cross Domain Local Storage Project (cad19ab9-7501-5377-a61f-9fdca3f8bf3a) |
|---|---|
| Product | Cross Domain Local Storage (745d8f57-2eaf-589d-8765-acbf8c93e82e) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/ofirdagan/cross-domain-local-storage |
purl2cpe | 2026-06-01 10:14:59.199512 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-11611 |
vulnerable | 2026-06-08 05:16:47.469697 |
Details available
An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.
Published: 2020-04-07T17:18:54.000Z
Updated: 2024-08-04T11:35:13.213Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-11610 |
vulnerable | 2026-06-08 05:16:47.469194 |
Details available
An issue was discovered in xdLocalStorage through 2.0.5. The postData() function in xdLocalStoragePostMessageApi.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
Published: 2020-04-07T17:19:06.000Z
Updated: 2024-08-04T11:35:13.412Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-9545 |
vulnerable | 2026-06-08 05:07:13.866837 |
Details available
An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
Published: 2020-04-07T17:18:41.000Z
Updated: 2024-08-06T08:51:05.356Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-9544 |
vulnerable | 2026-06-08 05:07:13.866401 |
Details available
An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
Published: 2020-04-07T17:19:21.000Z
Updated: 2024-08-06T08:51:05.314Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.