Description
Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.
Remediation
References
https://github.com/Graylog2/graylog2-server/pull/4727
https://www.graylog.org/post/announcing-graylog-v2-4-4
Related Vulnerabilities
CVE-2020-13128 Vulnerability in maven package com.googlecode.gwtupload:gwtupload-project
CVE-2020-15256 Vulnerability in npm package object-path
CVE-2021-21293 Vulnerability in maven package org.http4s:blaze-core_2.11
CVE-2021-23327 Vulnerability in npm package apexcharts
CVE-2020-26291 Vulnerability in maven package org.webjars.bower:urijs