CVE-2016-10744: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

May 14, 2022 (updated August 17, 2022)

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.

References

github.com/advisories/GHSA-rf66-hmqf-q3fc
github.com/select2/select2/issues/4587
github.com/snipe/snipe-it/pull/6831
github.com/snipe/snipe-it/pull/6831/commits/5848d9a10c7d62c73ff6a3858edfae96a429402a
nvd.nist.gov/vuln/detail/CVE-2016-10744

Code Behaviors & Features

Detect and mitigate CVE-2016-10744 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →