Threats tagged 'ghsa-c7fg-9fr9-89xp'

A Cross-Site Scripting (XSS) vulnerability exists in the Chat component of Progress Software's KendoReact library versions 0.6.0 through 16.1.0. This flaw allows a low-privileged attacker who can supply chat messages to execute arbitrary JavaScript in the context of the affected application. The vulnerability arises from unsafe handling of URLs in an openUrl quick action, which triggers when a user clicks the action.