technology software

corporate

English

_cfuvid

__cf_bm

_ga_JV9ZPW0V9J

_ga_10T3YGR0NH

The domain name 'help.loseit.com' uses the commercial generic top-level domain (.com) with subdomain 'help'. The second-level label 'loseit' is 6 characters long split between three vowels and three consonants. Tokenizing the label suggests two words: lose, it. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

utf8

query

html/97/b1/97b13a1e-4693-4efc-a960-0ef6a883c749.html.gz

attachment; filename="formatting-components.js"

attachment; filename="category-accordion.js"

inline; filename="4a2feac1e0b08a8620b53c49ca83c1b2c10ff5a3.png"

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:138:0

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:196:0

script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:164:0

inline; filename="d79f70c19d5cb17bcc43c3012146f34c0c515acd.png"

c421ea0a9f1ce10f57aecea56876ed58959bd1b4d2db3daaf9a959071b98dd80

b5f30e10f8b346a082531b150e1bedfd16115f4e3e879167b00981146a64f2ac

2745099369aab4531eb87d493f2a9b87b4cb3cbec8e2eae31084b949e3f7db06

a657bbd57ef44b8e88f44fc50bda08b6d4783a2a107faa6421083c507294e5de

f331163cfba9a7cefc6f3ec602b40a8618bd4c7b5390cf16695644922cb4af6e

dd2144bb7a813d5462b5c5c8ec84e704ab709189a8a85edaa78c48e5d11ec5a6

88f18177a4a9471106407a2fb9079ac0985fe3fbfe811067e55493e7fa7ef3d5

0785e2b2433cb69472a6dc71d2c6f64a58d73aa0735ca4838b5f0223b36898b6

ff096cb5577bb5c5f55f95cf19a1d5e0d96f183064794fb8373c4dfdbb3f59cf

a132c6166545a66751448b0598f4156185824d07aff713c70ef5aa1352b78d41

2653aee2cca1000f88103b40e288370b26193c38b96f66786066a08e872b8d83

0aad095337887f023ba3ab175a595ff9896232a97d5dc76406059911ed54448a

d8d5bb7e568ec788ef1f5f6b7b2ab96439b5658ec348196f987e24cf6ea59c10

1c7db277a41ec7c0d7a2083c1e34dc28ec36c4c92f42b0dc281d5786f3051631

bb37cf5b80c5cdeeb24318ae5d321f5031c685c341b617f7e9b49f8e11b18312

927d115b85fc553517cdef1ec0a3dac14b56527d170261152146f67b00c2ab53

3402c7f821b05ff6c2e6dc96fca0f324d094a3bbb05780afb8e91e405d382ccf

0e860da4a8ab9d9cfb840c948dca3bb81114230305f7623f6778a00e1f020890

cb7694aade314517b611360921dec0417899a994c90bee1315ea646b51535992

9990af598d5acd1f850ff585b6d97150cdc2569c24c3157112b6dd2169c6ffe8

parseHTML() executes scripts in event handlers

jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution

passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Regex in its jQuery.htmlPrefilter sometimes may introduce XSS

### Impact

Affected versions of this package are vulnerable to Prototype Pollution.  A malicious HTML code block can be crafted that will result in prototype pollution of the base object's prototype during highlighting.  If you allow users to insert custom HTML code blocks into your page/app via parsing Markdown code blocks (or similar) and do not filter the language names the user can provide you may be vulnerable. 

The pollution should just be harmless data but this can cause problems for applications not expecting these properties to exist and can result in strange behavior or application crashes, i.e. a potential DOS vector. 

_If your website or application does not render user provided data it should be unaffected._

### Patches

Versions 9.18.2 and 10.1.2 and newer include fixes for this vulnerability.  If you are using version 7 or 8 you are encouraged to upgrade to a newer release.

### Workarounds

#### Patch your library

Manually patch your library to create null objects for both `languages` and `aliases`:

```js
const HLJS = function(hljs) {
  // ...
  var languages = Object.create(null);
  var aliases = Object.create(null);
```

#### Filter out bad data from end users:

Filter the language names that users are allowed to inject into your HTML to guarantee they are valid.

### References

* [What is Prototype Pollution?](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)
* https://github.com/highlightjs/highlight.js/pull/2636

### For more information

If you have any questions or comments about this advisory:

* Please file an issue against [highlight.js](https://github.com/highlightjs/highlight.js/issues/)

### Impact: Potential ReDOS vulnerabilities (exponential and polynomial RegEx backtracking)

[oswasp](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS): 

> The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.

If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable.  On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service).

This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable.  If you are using `highlightAuto` to detect the language (and have any of these grammars registered) you are vulnerable. Exponential grammars (C, Perl, JavaScript) are auto-registered when using the common grammar subset/library `require('highlight.js/lib/common')` as of 10.4.0 - see https://cdn.jsdelivr.net/gh/highlightjs/cdn-release@10.4.0/build/highlight.js

All versions prior to 10.4.1 are vulnerable, including version 9.18.5. 

**Grammars with exponential backtracking issues:**

  - c-like (c, cpp, arduino)
  - handlebars (htmlbars)
  - gams
  - perl
  - jboss-cli
  - r
  - erlang-repl
  - powershell
  - routeros
  - livescript (10.4.0 and 9.18.5 included this fix)
  - javascript & typescript (10.4.0 included partial fixes)

And of course any aliases of those languages have the same issue. ie: `hpp` is no safer than `cpp`.

**Grammars with polynomial backtracking issues:**

- kotlin
- gcode
- d
- aspectj
- moonscript
- coffeescript/livescript
- csharp
- scilab
- crystal
- elixir
- basic
- ebnf
- ruby
- fortran/irpf90
- livecodeserver
- yaml
- x86asm
- dsconfig
- markdown
- ruleslanguage
- xquery
- sqf

And again: any aliases of those languages have the same issue. ie: `ruby` and `rb` share the same ruby issues.


### Patches

- Version 10.4.1 resolves these vulnerabilities.  Please upgrade.

### Workarounds / Mitigations

- Discontinue use the affected grammars. (or perhaps use only those with poly vs exponential issues)
- Attempt cherry-picking the grammar fixes into older versions...
- Attempt using newer CDN versions of any affected languages.  (ie using an older CDN version of the library with newer CDN grammars).  Your mileage may vary.

### References

- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:
* Open an issue: https://github.com/highlightjs/highlight.js/issues
* Email us at [security@highlightjs.com](mailto:security@highlightjs.com)

78e226ebe479b6c2fe38cd54e85a22ef6184958058128767c3ef0b71055e7519

94e7b99d1a1d4bfadb7fb43b5063d97e92b7fb2ad15db8d5e86126b6b9dd1a33

d8f3c53b63262149c470d9fed14e23baaf127bc87cfb2cda0c513481aaa03774

d012ca34f9b7c4006ef71577175c0dadc18ed6d0632b0af78c3cac2c7f162382

5ba1cf25dca3c4cb6d44373bd322cd10cbccaa4a012ecf41e0ced81c33347550

Canceling Your Subscription via LoseIt.com

Canceling Your Subscription via Google Play

Transfer Lose It! Premium to Different Account

How to Cancel a Lose It! Premium Subscription or Trial

csrf-param

hc:meta:server:gbmbtNKhtJKRaWyg29hXIVa--mc-JX8vUqkLsqNU1OLysMMke9oL8MzdwTBT9XC3vt313U5BH278tUsb1v9TVw

csrf-token

This article will explain the benefits and cost of Lose It! Premium.  In This ArticleLose It! Premium BenefitsLose It! Premium...

description

https://help.loseit.com/hc/theming_assets/01JS2K3P1PW8KCXX31J7RDJBK1

This article will explain the benefits and cost of Lose It! Premium.  In This ArticleLose It! Premium BenefitsLose It! Premium PricingTrial MembershipsUsing Premium Across DevicesLose It! Premium B...

https://help.loseit.com/hc/en-us/articles/27543644337563-What-is-Lose-It-Premium

viewport

CSC Corporate Domains, Inc.

LOSEIT.COM

Network Operations

Zendesk, Inc.

ZENDESK-NETWORK


  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());
  gtag('config', 'G-JV9ZPW0V9J');


(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-W4MMHVH');


  window.LotusConfig = {};
  LotusConfig.css = {
    activeClass: 'is-active',
    hiddenClass: 'is-hidden'
  };



  const currentURL = window.location.href;

  if (currentURL.includes('/articles/40195993432603-Contact-Us') || currentURL.includes('/requests/')) {
    const script = document.createElement("script");
    script.setAttribute("src", "https://solve-widget.forethought.ai/embed.js");
    script.setAttribute("id", "forethought-widget-embed-script");
    script.setAttribute("data-api-key", "b2a58c6e-da6e-4720-9bd8-fdc11e81576f");
    document.head.appendChild(script);
  }



  /*

    Greetings sourcecode lurker!

    This is for internal Zendesk and legacy usage,
    we don't support or guarantee any of these values
    so please don't build stuff on top of them.

  */

  HelpCenter = {};
  HelpCenter.account = {"subdomain":"loseit","environment":"production","name":"Lose It!"};
  HelpCenter.user = {"identifier":"da39a3ee5e6b4b0d3255bfef95601890afd80709","email":null,"name":"","role":"anonymous","avatar_url":"https://assets.zendesk.com/hc/assets/default_avatar.png","is_admin":false,"organizations":[],"groups":[]};
  HelpCenter.internal = {"asset_url":"//static.zdassets.com/hc/assets/","web_widget_asset_composer_url":"https://static.zdassets.com/ekr/snippet.js","current_session":{"locale":"en-us","csrf_token":"hc:hcobject:server:w75Nn6OgdEPTtyq_ZgRDFDCnmRRPUGaEOzQ_Vx5zpAiwtxUPCtvLIY4Dhy_uKWSC2MSWrj80BsWVKH_-a9gjvQ","shared_csrf_token":null},"usage_tracking":{"event":"article_viewed","data":"BAh7CDoLbG9jYWxlSSIKZW4tdXMGOgZFVDoPYXJ0aWNsZV9pZGwrCJv1IgENGToKX21ldGF7DDoPYWNjb3VudF9pZGkD6S4cOhNoZWxwX2NlbnRlcl9pZGwrCGMFi8YaADoNYnJhbmRfaWRpA0ApbDoMdXNlcl9pZDA6E3VzZXJfcm9sZV9uYW1lSSIOQU5PTllNT1VTBjsGVDsASSIKZW4tdXMGOwZUOhphbm9ueW1vdXNfdHJhY2tpbmdfaWQw--c6f7cd4a759700f9c8139fd7ced23ed897458308","url":"https://help.loseit.com/hc/activity"},"current_record_id":"27543644337563","current_record_url":"/hc/en-us/articles/27543644337563-What-is-Lose-It-Premium","current_record_title":"What is Lose It! Premium?","current_text_direction":"ltr","current_brand_id":7088448,"current_brand_name":"Lose It!","current_brand_url":"https://loseit.zendesk.com","current_brand_active":true,"current_path":"/hc/en-us/articles/27543644337563-What-is-Lose-It-Premium","show_autocomplete_breadcrumbs":true,"user_info_changing_enabled":false,"has_user_profiles_enabled":false,"has_end_user_attachments":true,"user_aliases_enabled":false,"has_anonymous_kb_voting":true,"has_multi_language_help_center":true,"show_at_mentions":false,"embeddables_config":{"embeddables_web_widget":false,"embeddables_help_center_auth_enabled":false,"embeddables_connect_ipms":false},"answer_bot_subdomain":"static","gather_plan_state":"subscribed","has_article_verification":true,"has_gather":true,"has_ckeditor":false,"has_community_enabled":false,"has_community_badges":false,"has_community_post_content_tagging":false,"has_gather_content_tags":false,"has_guide_content_tags":true,"has_user_segments":true,"has_answer_bot_web_form_enabled":false,"has_garden_modals":false,"theming_cookie_key":"hc-da39a3ee5e6b4b0d3255bfef95601890afd80709-2-preview","is_preview":false,"has_search_settings_in_plan":true,"theming_api_version":1,"theming_settings":{"toggle_translations":false,"body_bg":"#fff","brand_primary":"rgba(24, 57, 98, 1)","brand_secondary":"rgba(24, 57, 98, 1)","text_color":"#4e5565","link_color":"rgba(0, 0, 158, 1)","button_color":"rgba(33, 68, 112, 1)","brand_info":"rgba(82, 211, 255, 1)","brand_success":"rgba(82, 211, 255, 1)","brand_warning":"rgba(255, 148, 0, 1)","brand_danger":"rgba(255, 148, 0, 1)","font_size_base":"16px","font_family_base":"'Open Sans', sans-serif","line_height_base":"1.5","border_radius_base":"4px","border_width":"2px","logo":"/hc/theming_assets/01JS2K3P1PW8KCXX31J7RDJBK1","logo_height":"50px","favicon":"/hc/theming_assets/01HZPD4Z3R4RDDJ7CG98VY6X8T","toggle_help_center_title":false,"help_center_title":"Help Center","topbar_bg":"rgba(255, 255, 255, 1)","toggle_topbar_border":false,"topbar_border_color":"rgba(33, 68, 112, 1)","topbar_text_color":"#fff","topbar_link_color":"rgba(33, 68, 112, 1)","topbar_button_color":"rgba(49, 186, 233, 1)","footer_bg":"rgba(255, 255, 255, 1)","footer_text_color":"rgba(24, 57, 98, 1)","footer_link_color":"rgba(255, 148, 0, 1)","footer_social_link_color":"#fff","toggle_footer_creator_text":true,"footer_social_icon_height":"16px","toggle_custom_blocks":true,"toggle_promoted_articles":false,"toggle_category_list":false,"toggle_category_tree":true,"category_tree_type":"accordion","toggle_recent_activities":false,"hero_unit_mask_bg":"rgba(70, 110, 160, 1)","hero_unit_mask_opacity":".5","hero_homepage_image":"/hc/theming_assets/01HZPD4ZABCTNHK608KG72JCMF","hero_title":"How can we help?","search_placeholder":"Search...","icon_color":"rgba(24, 57, 98, 1)","icon_height":"56px","custom_block_1_toggle":true,"custom_block_1_type":"custom","custom_block_1_icon":"/hc/theming_assets/01HZPD4ZEPQRFQQ78R11V7Z3D7","custom_block_1_title":"Using Lose It!","custom_block_1_url":"https://help.loseit.com/hc/en-us/categories/25687691741979","custom_block_2_toggle":false,"custom_block_2_type":"custom","custom_block_2_icon":"/hc/theming_assets/01HZPD4ZVF84A2QCJHKRZJTMYY","custom_block_2_title":"Billing \u0026 Subscriptions","custom_block_2_url":"https://help.loseit.com/hc/en-us/categories/115001079887-Manage-Subscription-Refund","custom_block_3_toggle":false,"custom_block_3_type":"custom","custom_block_3_icon":"/hc/theming_assets/01HZPD5084EMHWBYCVTMWBRAK1","custom_block_3_title":"Community","custom_block_3_url":"#","custom_block_4_toggle":false,"custom_block_4_type":"custom","custom_block_4_icon":"/hc/theming_assets/01HZPD50C7R0FS3TBX57ZYZBZY","custom_block_4_title":"Hidden","custom_block_4_url":"#","custom_block_5_toggle":true,"custom_block_5_type":"custom","custom_block_5_icon":"/hc/theming_assets/01HZPD50GSDWPQY7002D37JYJM","custom_block_5_title":"Cancel My Subscription","custom_block_5_url":"https://help.loseit.com/hc/en-us/articles/115006017887-How-to-Cancel-a-Lose-It-Premium-Subscription-or-Trial","custom_block_6_toggle":true,"custom_block_6_type":"custom","custom_block_6_icon":"/hc/theming_assets/01HZPD50N9Q2JZTF9XDS10MF3Y","custom_block_6_title":"Request a Refund","custom_block_6_url":"https://help.loseit.com/hc/en-us/articles/27543264074907-How-to-Get-a-Refund-for-Lose-It-Premium","bottom_cta_title":"Can't find what you're looking for?","bottom_cta_subtitle":"","toggle_facebook_icon":false,"facebook_url":"https://facebook.com","toggle_twitter_icon":false,"twitter_url":"","toggle_youtube_icon":false,"youtube_url":"","toggle_linkedin_icon":false,"linkedin_url":"","toggle_instagram_icon":false,"instagram_url":""},"has_pci_credit_card_custom_field":true,"help_center_restricted":false,"is_assuming_someone_else":false,"flash_messages":[],"user_photo_editing_enabled":true,"user_preferred_locale":"en-us","base_locale":"en-us","login_url":"https://loseit.zendesk.com/access?locale=en-us\u0026brand_id=7088448\u0026return_to=https%3A%2F%2Fhelp.loseit.com%2Fhc%2Fen-us%2Farticles%2F27543644337563-What-is-Lose-It-Premium","has_alternate_templates":true,"has_custom_statuses_enabled":true,"has_hc_generative_answers_setting_enabled":true,"has_generative_search_with_zgpt_enabled":true,"has_suggested_initial_questions_enabled":false,"has_guide_service_catalog":false,"has_service_catalog_search_poc":false,"has_service_catalog_itam":false,"has_csat_reverse_2_scale_in_mobile":false,"has_knowledge_navigation":false,"has_trial_presumptive_setup":true,"has_unified_navigation":true,"has_unified_navigation_eap_access":true,"has_knowledge_global_nav_ga_banner":false,"has_csat_bet365_branding":false,"has_help_center_gen_search_follow_up_conversation":false,"version":"v27285","dev_mode":false};


Open-Graph-Protocol

Cloudflare Bot Management

Google Tag Manager

HSTS

Envoy

Cloudflare

Google Analytics

jsDelivr

jQuery

Zendesk

Just a moment...

Tracking domain: region1.google-analytics.com

region1.google-analytics.com

Tracking domain: www.googletagmanager.com

www.googletagmanager.com

Tracking domain: region1.analytics.google.com

region1.analytics.google.com

stats.g.doubleclick.net

✅ Low Risk - https://help.loseit.com/hc/en-us/articles/27543644337563-What-is-Lose-It-Premium

Requests	IP Address	Location	AS Autonomous System
21	104.18.95.41	United States	AS13335Cloudflare, Inc.
21	216.198.54.11	United States	AS209242Cloudflare London, LLC
42	2	-	-

Security Scan Report: help.loseit.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Website Access Blocked

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies10

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History