# XSS Published articles for XSS. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## \[webapps\] Bludit CMS - Stored XSS DevFeed: [\[webapps\] Bludit CMS - Stored XSS]() Original publisher: [Read original article]() Author: Saud Alenazi Published: 2026-09-01T00:00:00Z Content type: article Language: en Sources: [Exploit-DB.com RSS Feed]() Topics: [XSS](), [Content Management System](), [webapps](), [Exploit]() Tags: [cms](), [exploit](), [multiple](), [stored](), [webapps](), [xss]() ### AI overview A concise exploit entry describing stored cross-site scripting (XSS) in Bludit CMS for web applications across multiple platforms. ### Source excerpt Bludit CMS - Stored XSS ## \[webapps\] CubeCart 6.7.4 - Stored XSS DevFeed: [\[webapps\] CubeCart 6.7.4 - Stored XSS]() Original publisher: [Read original article]() Author: Mikail KOCADAĞ Published: 2026-08-31T00:00:00Z Content type: article Language: en Sources: [Exploit-DB.com RSS Feed]() Topics: [XSS](), [Exploit]() Tags: [cve](), [cve-2026-54645](), [exploit](), [multiple](), [platform](), [stored](), [webapps](), [xss]() ### AI overview An exploit entry for CubeCart 6.7.4 describing a stored cross-site scripting vulnerability identified as CVE-2026-54645. It is categorized as a web applications exploit for multiple platforms. ### Source excerpt CubeCart 6.7.4 - Stored XSS ## \[webapps\] C-MOR 6.0104 - Cross-Site Scripting (XSS) DevFeed: [\[webapps\] C-MOR 6.0104 - Cross-Site Scripting (XSS)]() Original publisher: [Read original article]() Author: Samir Shamdin Published: 2026-08-31T00:00:00Z Content type: article Language: en Sources: [Exploit-DB.com RSS Feed]() Topics: [webapps](), [XSS](), [Exploit](), [Hardware]() Tags: [cve](), [cve-2026-51133](), [exploit](), [hardware](), [webapps](), [xss]() ### AI overview A C-MOR 6.0104 entry documenting a Cross-Site Scripting (XSS) exploit identified as CVE-2026-51133. ### Source excerpt C-MOR 6.0104 - Cross-Site Scripting (XSS) ## Keycloak 26.6.4 released DevFeed: [Keycloak 26.6.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-06-26T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authentication](), [Authorization](), [JSON Web Tokens](), [upgrade](), [Quarkus]() Tags: [2026](), [authentication](), [authorization](), [idm](), [jwt](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [quarkus](), [reference](), [release](), [saml](), [security](), [sso](), [upgrade](), [xss]() ### AI overview Keycloak 26.6.4 is released with security fixes addressing privilege escalation, information disclosure, cross-site scripting, authentication and authorization bypasses, and other issues. The release also upgrades Quarkus to 3.33.2.1. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #50344 CVE-2026-9099 Keycloak: group-admin escalation to realm-admin #50345 CVE-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing #50347 CVE-2026-9086 Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass #50349 CVE-2026-9705 Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token #50350 CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement #50351 CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass #50352 CVE-2026-9800 Keycloak: keycloak policy enforcer: authorization bypass via incorrect uri comparison #50357 CVE-2026-11800 Keycloak: Authentication bypass via JWT algorithm confusion Enhancements #50100 Upgrade to Quarkus 3.33.2.1 Bugs #47999 [Keycloak JavaScript CI] - Build Keycloak ci #49639 Keycloak Admin Client tests fails in CI ci #49700 Incorrect migration guide reference docs #49707 Cannot build project due to ISPN protoschema and 26.2 branch infinispan #49733 keycloak-api-docs-dist is not deployable dist/quarkus ## Security Risks in Modern JavaScript Frameworks: React, Dependencies, and Client-Side Data Handling DevFeed: [Security Risks in Modern JavaScript Frameworks: React, Dependencies, and Client-Side Data Handling]() Original publisher: [Read original article]() Author: snehaa Published: 2026-06-10T09:09:52Z Content type: article Language: en Sources: [Backend Archives | Talent500 blog]() Topics: [Security](), [JavaScript](), [React](), [Web](), [web applications]() Tags: [api](), [authentication](), [backend](), [csp](), [framework-vulnerabilities](), [frontend](), [frontend-security](), [javascript](), [javascript-security](), [newsletters](), [npm-security](), [react](), [react-security](), [security](), [supply-chain](), [supply-chain-attacks](), [technology](), [vulnerabilities](), [xss]() ### AI overview The article examines security risks in modern JavaScript applications, focusing on React data handling, dangerous DOM sinks, dependency supply-chain complexity, and configuration issues that can contribute to XSS, injection, data leakage, and vulnerable code reaching production. ### Source excerpt Modern JavaScript frameworks have transformed how web applications are built, but they have also introduced new, less visible security risks. [...] The post Hidden Security Risks in Modern JavaScript Frameworks appeared first on Talent500 blog. ## Keycloak 26.6.2 released DevFeed: [Keycloak 26.6.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-05-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Vulnerabilities](), [Security](), [Authentication](), [OpenID connect (OIDC)](), [WebAuthn](), [XSS]() Tags: [2](), [2026](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [permission](), [pii](), [release](), [saml](), [security](), [sso](), [vulnerability](), [xss]() ### AI overview Keycloak 26.6.2 is a security-focused release that fixes multiple vulnerabilities, including denial-of-service issues, request smuggling, access-control flaws, stored XSS, WebAuthn policy bypass, token disclosure, account takeover, and PII enumeration. It also includes enhancements and bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn #48570 [CVE-2026-0636, CVE-2026-3505, CVE-2026-5598] Multiple bouncycastle CVEs core #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access) #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration Enhancements #47728 Monitor backups for CNPG - ## Mintlify Security Event - November 2025 DevFeed: [Mintlify Security Event - November 2025]() Original publisher: [Read original article]() Author: Han Wang Published: 2025-12-18T00:00:00Z Content type: article Language: en Sources: [Mintlify Blog]() Topics: [Security](), [Vulnerabilities](), [XSS](), [incident](), [hosting](), [web applications]() Tags: [2025](), [announcements](), [hosting](), [incident](), [security](), [vulnerabilities](), [xss]() ### AI overview Mintlify describes how security researchers identified a cross-domain XSS vulnerability in its static asset hosting in November 2025. The company deployed a fix within 45 minutes, purged caches, audited hosted assets, notified potentially affected customers, and collaborated with the researchers on testing and further security improvements. ### Source excerpt How a week-long collaboration with security researchers helped us identify and fix vulnerabilities, making Mintlify more secure for everyone. ## Welcome to AI pentesting - add on-demand AI assistance directly to your workflow with new, agentic Burp AI capabilities DevFeed: [Welcome to AI pentesting - add on-demand AI assistance directly to your workflow with new, agentic Burp AI capabilities]() Original publisher: [Read original article]() Author: Amelia Coen Published: 2025-09-24T14:17:34Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Artificial Intelligence](), [Security](), [Testing](), [Vulnerabilities]() Tags: [agentic](), [ai](), [bounty](), [security](), [testing](), [tools](), [validation](), [vulnerabilities](), [workflow](), [xss]() ### AI overview The article introduces agentic Burp AI capabilities that provide on-demand assistance within penetration-testing workflows. Burp AI can explain behavior, suggest attack ideas and payloads, validate findings, analyze request and response data, automate repetitive tasks, and help test for vulnerabilities such as stored XSS while keeping the tester in control. ### Source excerpt Whether you're navigating a client pentest or chasing a bounty target, even the most experienced testers hit roadblocks, burn time on repetitive tasks, or just want a second opinion. Burp AI is design ## Astro 5.9 DevFeed: [Astro 5.9]() Original publisher: [Read original article]() Author: Emanuele Stoppa; Matt Kane Published: 2025-06-05T00:00:00Z Content type: release Language: en Sources: [The Astro Blog]() Topics: [Astro](), [Security](), [Markdown](), [Web Development]() Tags: [astro](), [cli](), [csp](), [markdown](), [security](), [xss]() ### AI overview Astro 5.9 introduces experimental Content Security Policy support, Markdown rendering in content loaders, optional removal of default styles for experimental responsive images, and adapter controls for suppressing feature-support logs. ### Source excerpt Astro 5.9 has got your site on lockdown, with experimental support for Content Security Policy, rendering Markdown in content loaders, and more! ## Document My Pentest: you hack, the AI writes it up! DevFeed: [Document My Pentest: you hack, the AI writes it up!]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-04-23T13:17:24Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Artificial Intelligence](), [Extension](), [audit trail](), [Security](), [Testing](), [Web](), [Open Source](), [Regular expression]() Tags: [ai](), [audit-trail](), [extension](), [open-source](), [security](), [testing](), [vulnerabilities](), [web](), [xss]() ### AI overview The article introduces Document My Pentest, an open-source Burp Suite extension that uses Burp AI features to observe web-security testing activity in real time and build a structured audit trail. It describes generating reports with AI and explains prototype lessons, including difficulties analyzing complete requests and responses, successful detection of clear Path Traversal evidence, and a regex-based approach for identifying reflected input. The approach worked for some reflected-data cases but was not suitable for attacks such as Request Smuggling. ### Source excerpt Tired of repeating yourself? Automate your web security audit trail. In this post I'll introduce a new Burp AI extension that takes the boring bits out of your pen test. Web security testing can be a ## Shadow Repeater:AI-enhanced manual testing DevFeed: [Shadow Repeater:AI-enhanced manual testing]() Original publisher: [Read original article]() Author: Gareth Heyes Published: 2025-02-20T13:20:19Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Artificial Intelligence](), [Testing](), [Vulnerabilities](), [Extension](), [Code]() Tags: [ai](), [attacks](), [automatic](), [code](), [extension](), [github](), [request](), [testing](), [vulnerabilities](), [xss]() ### AI overview Shadow Repeater is a Burp Repeater extension that enhances manual security testing with AI-powered automatic variation testing. It analyzes changed parameters and payloads, generates variants through an AI model, tests them against the target, and uses response diffing to identify potentially interesting behavior and vulnerabilities. ### Source excerpt Have you ever wondered how many vulnerabilities you've missed by a hair's breadth, due to a single flawed choice? We've just released Shadow Repeater, which enhances your manual testing with AI-powere ## Top 10 web hacking techniques of 2024 DevFeed: [Top 10 web hacking techniques of 2024]() Original publisher: [Read original article]() Author: James Kettle Published: 2025-02-04T15:01:48Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [Hacking](), [Application Security](), [Security](), [web applications](), [OAuth](), [Cache](), [account takeover](), [LocalStorage](), [JavaScript]() Tags: [2025](), [account-takeover](), [cache](), [chatgpt](), [cookies](), [hacking](), [oauth](), [research](), [security](), [techniques](), [web](), [xss]() ### AI overview This annual community-powered review identifies notable web security research and hacking techniques from 2024. The supplied excerpts discuss OAuth flow hijacking through Cookie Tossing, risks involving cookies and JavaScript's Same-Origin Policy, and a ChatGPT account takeover using inconsistent decoding, path traversal, and Web Cache Deception. ### Source excerpt Welcome to the Top 10 Web Hacking Techniques of 2024, the 18th edition of our annual community-powered effort to identify the most innovative must-read web security research published in the last year ## Stealing HttpOnly cookies with the cookie sandwich technique DevFeed: [Stealing HttpOnly cookies with the cookie sandwich technique]() Original publisher: [Read original article]() Author: Zakhar Fedotkin Published: 2025-01-22T14:45:11Z Content type: article Language: en Sources: [PortSwigger Research]() Topics: [vulnerability](), [Exploit](), [Chrome](), [Cross-origin resource sharing (CORS)](), [browser](), [Web]() Tags: [browser](), [chrome](), [cors](), [vulnerability](), [web](), [xss]() ### AI overview This security research describes the "cookie sandwich" technique, which abuses legacy cookie parsing, quoted values, and browser behavior to bypass the HttpOnly flag on certain servers. By manipulating cookie structure, reflected parameters, analytics identifiers, CORS requests with credentials, or same-origin XSS, an attacker may expose sensitive HttpOnly cookie values to client-side scripts. ### Source excerpt In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie ## Snyk Code Improves Contextual Dataflow Analysis for Taint Vulnerabilities DevFeed: [Snyk Code Improves Contextual Dataflow Analysis for Taint Vulnerabilities]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-10-10T05:00:00Z Content type: release Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk-code](), [code security](), [Vulnerabilities](), [Security]() Tags: [awareness](), [blog](), [code-security](), [data](), [developer](), [devrel](), [feature](), [security](), [snyk](), [snyk-code](), [vulnerability](), [xss]() ### AI overview Snyk Code introduces an improved contextual dataflow view for taint vulnerabilities. The update highlights the critical steps in a dataflow path so developers can assess potential true positives and address security issues more efficiently. ### Source excerpt Snyk Code's enhanced dataflow analysis simplifies vulnerability identification and remediation. Learn how this powerful tool streamlines the security process and saves developers valuable time. ## Building a Real-Time Chat Application with WebSockets DevFeed: [Building a Real-Time Chat Application with WebSockets]() Original publisher: [Read original article]() Author: admin Published: 2024-05-06T07:40:48Z Content type: tutorial Language: en Sources: [Posts on Chris Banes]() Topics: [WebSocket](), [real-time](), [Socket.IO](), [App](), [Node.js](), [servers](), [browser](), [Security](), [client](), [Sanitization](), [Authentication](), [Authorization]() Tags: [app](), [authentication](), [authorization](), [browser](), [building](), [code](), [node](), [real-time](), [scalability](), [security](), [uncategorized](), [websocket](), [xss]() ### AI overview This tutorial explains how to build a real-time chat application with WebSockets and Socket.IO. It covers the two-way browser-server connection, a basic Node.js server that broadcasts chat messages, client-side message handling, and security considerations including input sanitization, authentication, authorization, and XSS prevention. ### Source excerpt Have you ever wished your online chats felt more like actual conversations, without needing to constantly refresh the page for new messages? If so, WebSockets are the answer! WebSockets let you build real-time chat apps where messages flow instantly. Unlike regular websites, WebSockets keep a connection open between your app and the server. That means [...] ## 7 tips to become a successful bug bounty hunter DevFeed: [7 tips to become a successful bug bounty hunter]() Original publisher: [Read original article]() Author: Ben Sadeghipour Published: 2024-01-25T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Bug Bounty](), [Vulnerabilities](), [Security](), [Hacking](), [web applications]() Tags: [ambassador](), [awareness](), [blog](), [bug-bounty](), [code-security](), [developer](), [hacking](), [open-source-security](), [security](), [snyk-security-intel](), [sql](), [tech](), [testing](), [vulnerability](), [vulnerability-disclosure](), [web-applications](), [xss]() ### AI overview This article explains bug bounty hunting, including how security researchers identify and responsibly report vulnerabilities in web applications, IoT devices, mobile applications, and smart contracts. It distinguishes vulnerability disclosure programs from bug bounty programs and recommends that beginners start with a Vulnerability Disclosure Program before pursuing paid bug bounties. ### Source excerpt In this post, we'll cover what bug bounty hunting is, the difference between vulnerability disclosure programs and bug bounty programs, and seven tips to get you started. ## Understanding and mitigating the Jinja2 XSS vulnerability (CVE-2024-22195) DevFeed: [Understanding and mitigating the Jinja2 XSS vulnerability (CVE-2024-22195)]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-01-18T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [vulnerability](), [Security](), [Python](), [Library](), [Scripting]() Tags: [awareness](), [blog](), [cve](), [dependencies](), [developer](), [devrel](), [open-source-security](), [python](), [python-dependencies](), [security](), [snyk](), [snyk-open-source](), [vulnerability](), [xss]() ### AI overview This article explains the Jinja2 cross-site scripting vulnerability CVE-2024-22195, which affects versions before 3.1.3. It describes the vulnerable filter behavior, the potential for injecting arbitrary HTML attributes and executing untrusted scripts in a browser, and ways to check project dependencies and scan them with Snyk. ### Source excerpt On January 11th, 2024, a significant security vulnerability was disclosed in Jinja2, a widely used Python templating library. Identified as CVE-2024-22195, this cross-site scripting (XSS) vulnerability has raised concerns due to its impact on numerous projects. ## Mitigating DOM clobbering attacks in JavaScript DevFeed: [Mitigating DOM clobbering attacks in JavaScript]() Original publisher: [Read original article]() Author: Keshav Malik Published: 2023-08-07T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Document Object Model (DOM)](), [JavaScript](), [Application Security](), [web applications](), [Vulnerabilities](), [HTML]() Tags: [application-security](), [attacks](), [awareness](), [blog](), [browser](), [code-security](), [contentlab](), [developer](), [html](), [html-elements](), [javascript](), [security](), [snyk-code](), [snyk-open-source](), [time](), [web-applications](), [xss]() ### AI overview This article explains DOM clobbering, a condition in which HTML element IDs or name attributes conflict with global JavaScript variables or functions. It describes how browsers create global variables from these attributes, how conflicts can overwrite existing functions, and how attackers may exploit the behavior to cause unpredictable behavior or security vulnerabilities such as cross-site scripting (XSS). ### Source excerpt This article explores the concept of DOM clobbering and provides strategies for building more secure and robust web applications. ## Astro 0.23 Release Notes DevFeed: [Astro 0.23 Release Notes]() Original publisher: [Read original article]() Author: Fred Schott Published: 2022-02-19T00:00:00Z Content type: release Language: en Sources: [The Astro Blog]() Topics: [Astro](), [Release notes](), [releases](), [Security](), [Vulnerabilities](), [HTML](), [JavaScript](), [TypeScript](), [Vite](), [JSON](), [XML]() Tags: [astro](), [browser](), [code](), [env-file-security](), [environment-variables](), [html](), [javascript](), [json](), [release](), [release-notes](), [security](), [typescript](), [vite](), [vulnerabilities](), [xss]() ### AI overview Astro v0.23.0 introduces dynamic file routes for generating JSON, XML, and non-text assets such as images during builds. The release also begins automatic HTML escaping for template expressions to reduce XSS risks, adds directives for controlled HTML and text insertion, and updates access to sensitive environment variables. The article highlights Vite 2.8 among the release changes. ### Source excerpt Introducing: Dynamic file routes - Automatic XSS protection - two new component directives - vite 2.8 - and more! ## Node.js 16.6.2 (Current) DevFeed: [Node.js 16.6.2 (Current)]() Original publisher: [Read original article]() Published: 2021-08-11T16:42:12Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [Vulnerabilities](), [JavaScript](), [TLS (Transport Layer Security)]() Tags: [dns](), [memory](), [node-js](), [release](), [remote-code-execution](), [vulnerabilities](), [xss]() ### AI overview Node.js 16.6.2 is a security-focused current release that addresses hostname validation issues in the DNS library, a use-after-free vulnerability in HTTP/2 stream cancellation, and incomplete validation of the HTTPS rejectUnauthorized parameter. It also includes dependency, HTTP/2, TLS, and c-ares updates. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 14.17.5 (LTS) DevFeed: [Node.js 14.17.5 (LTS)]() Original publisher: [Read original article]() Published: 2021-08-11T16:41:40Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [Exploit](), [Vulnerabilities](), [JavaScript](), [cross-platform](), [Open Source](), [Command-line interface]() Tags: [command-line](), [cross-platform](), [javascript](), [lts](), [node-js](), [open-source](), [remote-code-execution](), [update](), [vulnerabilities](), [xss]() ### AI overview Node.js 14.17.5 is an LTS security release addressing vulnerabilities in DNS hostname handling, HTTP/2 stream cancellation, and HTTPS certificate validation. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Node.js 12.22.5 (LTS) DevFeed: [Node.js 12.22.5 (LTS)]() Original publisher: [Read original article]() Published: 2021-08-11T16:41:05Z Content type: release Language: en Sources: [Node.js Blog]() Topics: [Node.js](), [Vulnerabilities](), [TLS (Transport Layer Security)]() Tags: [dns](), [lts](), [node-js](), [release](), [remote-code-execution](), [tls](), [vulnerabilities](), [xss]() ### AI overview Node.js 12.22.5 is an LTS release that addresses security vulnerabilities in the DNS, HTTP/2, and HTTPS functionality. It includes fixes for hostname validation, a use-after-free issue during HTTP/2 stream cancellation, and incomplete validation of the rejectUnauthorized parameter, along with dependency updates and additional tests. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## Cross-Origin Web Sessions DevFeed: [Cross-Origin Web Sessions]() Original publisher: [Read original article]() Author: info@goteleport.com (Russell Jones) Published: 2021-05-04T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Web](), [web applications](), [Cookies](), [Security](), [XSS]() Tags: [cookies](), [http](), [request](), [security](), [vulnerabilities](), [web](), [web-applications](), [xss]() ### AI overview This article examines mechanisms for securely transferring user sessions between web applications hosted on different domains. It explains browser cookies, session tokens, domain limitations, and query parameters as one approach for cross-origin session sharing. ### Source excerpt Russell examines the available mechanisms for securely transferring user sessions across different web applications running at different domains. ## CSRF Attacks: Examples and Mitigations DevFeed: [CSRF Attacks: Examples and Mitigations]() Original publisher: [Read original article]() Author: info@goteleport.com (Russell Jones) Published: 2021-03-25T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Exploit](), [web applications](), [browser](), [Cookies](), [HTML](), [HTTP](), [account takeover](), [Code]() Tags: [account-takeover](), [browser](), [code](), [cookies](), [exploit](), [html](), [http](), [xss]() ### AI overview This tutorial explains how Cross-Site Request Forgery (CSRF) attacks use browsers, HTML elements, cookies, and ambient credentials to submit requests as a logged-in user. It presents examples of state-changing requests and discusses their security impact and mitigations. ### Source excerpt Understanding Cross-Site Request Forgery (CSRF) and its Mitigations. [Next page]()