6900 matches found
SUSE CVE-2021-22931
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames leading to Domain Hijacking and injection...
SUSE CVE-2021-22940
Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior...
SUSE CVE-2022-0520
Use After Free in NPM radare2.js prior to 5.6.2...
SUSE CVE-2022-0522
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2...
TD Bank: Reflected XSS on marketsandresearch.td.com
Summary: Hi TD security team, there is a reflected XSS vulnerability at http://marketsandresearch.td.com. As you are most likely aware, XSS vulnerabilities can have significant security implications, including allowing an attacker to inject malicious JS code into the application, which is then...
CVE-2023-0075
The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0075
CVE-2023-0075 affects the Amazon JS WordPress plugin, versions 0.10 and earlier. The vuln stems from not validating/escaping certain shortcode attributes, allowing stored XSS when rendered on a page/post where the shortcode is embedded. Impact: attackers with contributor role or higher can execut...
CVE-2023-0075 Amazon JS <= 0.10 - Contributor+ Stored XSS
The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
PT-2023-10258 · Walrusirc · Walrusirc
Name of the Vulnerable Software and Affected Versions: juju2143 WalrusIRC version 0.0.2 Description: A problem was found in the function parseLinks of the file public/parser.js. The manipulation of the argument text leads to cross-site scripting. The attack may be initiated remotely...
WordPress plugin Amazon JS 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...
CVE-2023-0075: Undefined Security Weakness
The Amazon JS WordPress plugin through 0.10 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-22735
Zulip is an open-source team collaboration tool. In versions of zulip prior to commit "2f6c5a8" but after commit "04cf68b" users could upload files with arbitrary "Content-Type" which would be served from the Zulip hostname with "Content-Disposition: inline" and no "Content-Security-Policy" heade...
js-lasertechnik.de Cross Site Scripting vulnerability OBB-3185627
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM : Grunt vulnerabilities (USN-5847-1)
The remote Ubuntu 18.04 ESM / 20.04 ESM / 22.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5847-1 advisory. It was discovered that Grunt was not properly loading YAML files before parsing them. An attacker could possibly use this issue t...
CVE-2023-23937
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid...
CVE-2023-23937
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid...
CVE-2021-36535
Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjsseterrorf...
Buffer overflow
Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjsseterrorf...
CVE-2021-36535
CVE-2021-36535 describes a buffer overflow in Cesanta mJS 1.26. The issue affects the mjs_set_errorf path and can be triggered by a crafted .js file, leading to denial of service. The available connected documents corroborate the target as Cesanta mJS 1.26 and the impact as availability loss (DoS...
