4569 matches found
PT-2019-14298
Name of the Vulnerable Software and Affected Versions GitLab version 12.2.3 Description The issue allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments. Recommendations For GitLab version 12.2.3, update to a version that contains a fix for th...
CVE-2019-15593: Uncontrolled Resource Consumption
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments...
PT-2019-6650
Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.5 Description An access bypass issue allows non-privileged users to download files attached to comments if they know or guess the direct URL of the file, even when the parent node is denied access. This issue is...
GHSA-FM68-89M8-4GJJ Composer JavaScript injection possible via html comments
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments...
DEBIAN-CVE-2019-10219
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
CVE-2019-10219
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
Design/Logic Flaw
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
UBUNTU-CVE-2019-10219
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
CVE-2019-10219
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
CVE-2019-10219: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
Mozilla: Incorrect HTML parsing results in XSS bypass technique
A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...
CVE-2019-8233
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments...
Hardcoded credentials
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments...
Magento cross-site scripting vulnerability (CNVD-2019-40833)
Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento 2.2 version and 2.3 version of a security vulnerability , the vulnerability stems from the cleaning engin...
CVE-2019-8233
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments...
PT-2019-18947
Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1 Description The issue allows an unauthenticated user to inject arbitrary JavaScript code due to the sanitization engine ignoring HTML comments. Recommendation...
CVE-2019-8233: Improper Neutralization of Input During Web Page Generation
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments...
Mozilla: Incorrect HTML parsing results in XSS bypass technique
A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...
