6885 matches found
CVE-2020-27783
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...
CVE-2020-27783: Improper Neutralization of Input During Web Page Generation
A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...
CVE-2020-27783
A Cross-site Scripting XSS vulnerability was found in the python-lxml's clean module. The module's parser did not properly imitate browsers, causing different behaviors between the sanitizer and the user's page. This flaw allows a remote attacker to run arbitrary HTML/JS code. The highest threat...
PT-2020-17091
Name of the Vulnerable Software and Affected Versions LiquidFiles versions prior to 3.3.19 Description A Cross-Site Script Inclusion issue was found, which is a client-side attack that requires user interaction, such as opening a link. Successful exploitation could lead to encrypted e-mail conten...
CVE-2020-29072: Inclusion of Functionality from Untrusted Control Sphere
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction opening a link and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js...
Glassdoor: Reflected XSS at https://www.glassdoor.com/ via the 'numSuggestions' parameter
Hi there, I have found the xss vulnerability at: https://www.glassdoor.com/ via parameter: numSuggestions Summary: Affected Parameter: numSuggestions Browsers tested: Firefox, Chrome, Edge latest version Steps To Reproduce: Go to:...
@bigab/gulp-testee (>=0.0.1, <=0.0.2), books-fe-polymer-dev-sample (1.0.0) +13 more potentially affected by CVE-2021-23330 via launchpad (>=0.2.1, <=0.7.5)
launchpad NPM version =0.2.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =1.0.1, =0.2.0, =0.0.1, =0.0.5, =2.0.15, =1.0.1, =2.0.3, =3.4.2 Source cves: CVE-2021-23330 Source advisory: SNYK:JS-LAUNCHPAD-1044065...
Stored XSS by authenticated backend user with access to upload files
Impact Backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under t...
AZL-32281 CVE-2020-8277 affecting package python-gevent for versions less than 21.1.2-3
A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions 15.2.1, 14.15.1, and 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and...
Google Firebase Js Sdk prototype contamination vulnerability
Google Firebase Js Sdk is a client-side code base for connecting to the Firebase backend service from Google. firebase/util versions prior to 0.3.4 contain a prototype contamination vulnerability that originates from the deepExtend function in DeepCopy.ts. An attacker could exploit this...
Debian: Security Advisory (DSA-4789-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4789-1 : codemirror-js - security update
It was discovered that codemirror, a browser-based text editor implemented in JavaScript, was vulnerable to regular expression denial-of-service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4789. The text...
Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Cod...
GHSA-M9HW-7XFV-WQG7 Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Cod...
[SECURITY] [DSA 4789-1] codemirror-js security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4789-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 12, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4789-1] codemirror-js security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4789-1 [email protected] https://www.debian.org/security/ Sebastien Delafond November 12, 2020 https://www.debian.org/security/faq -...
PT-2020-21399
Name of the Vulnerable Software and Affected Versions json-logic-js versions prior to 2.0.0 Description The issue allows a malicious user to modify the prototype of Object through the method property name in the operation method. This can lead to modification of any existing property that will...
DSA-4789-1 codemirror-js - security update
Bulletin has no description...
