A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
A flaw was found in Bootstrap before 3.4.0. XSS is possible in the tooltip data-viewport attribute.
References: https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ https://github.com/twbs/bootstrap/issues/27044 https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906 https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628
Upstream Patch: https://github.com/twbs/bootstrap/pull/27047
A flaw was found in Bootstrap before 3.4.0. XSS is possible in the affix configuration target property.
References: https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ https://github.com/twbs/bootstrap/issues/27045 https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906 https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628
Upstream Patch: https://github.com/twbs/bootstrap/pull/27047
A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.
Bootstrap is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the data-target attribute. A remote attacker could exploit this vulnerability to execute script in a victim's Web browser within the security context of the hosting Web site. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
A flaw was found in Bootstrap from version 4.0 and before 4.1.2. A Cross-site Scripting (XSS) is possible in the data-container property of tooltip.
References: https://github.com/twbs/bootstrap/issues/26628
Upstream Patch: https://github.com/twbs/bootstrap/pull/26630
A flaw was found in Bootstrap from version 4.0 and before 4.1.2. A Cross-site Scripting (XSS) is possible in the collapse data-parent attribute.
References: https://github.com/twbs/bootstrap/issues/26625
Upstream Patch: https://github.com/twbs/bootstrap/pull/26630
A flaw was found in Bootstrap from version 4.0 and before 4.1.2. A Cross-site Scripting (XSS) is possible in the data-target property of scrollspy.
References: https://github.com/twbs/bootstrap/issues/26627
Upstream Patch: https://github.com/twbs/bootstrap/pull/26630