34 matches found
EUVD-2018-0786
Malware in sbrugna...
EUVD-2019-3822
Malware in sbrugna...
CVE-2024-34449
Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...
BIT-MOODLE-2024-28593
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...
Cross Site Scripting (XSS)
vditor is vulnerable to Cross Site Scripting XSS. The vulnerability is due to a lack of default xss sanitization within the editor, which allows an attacker to execute XSS via an attribute of an A element...
Vditor allows Cross-site Scripting via an attribute of an `A` element
Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...
CVE-2024-34449
Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...
CVE-2024-34449
Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...
CVE-2024-34449
CVE-2024-34449 affects Vditor 3.10.3, with XSS via an attribute of an A element. The underlying issue is insufficient sanitization; vendor guidance is to mitigate by enabling sanitize=true. CVSS 3.1 base score 6.1 (Network attack, low complexity, no privilege, user interaction required, scope cha...
CVE-2024-34449
Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...
CVE-2024-34449: Improper Neutralization of Input During Web Page Generation
Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
Cross site scripting
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript: substring in an A element...
CVE-2022-40317: Improper Neutralization of Input During Web Page Generation
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
CVE-2019-12173
MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...
PT-2019-12679
Name of the Vulnerable Software and Affected Versions MacDown version 0.7.1 Description The issue allows remote code execution via a file: URI with a .app pathname in the HREF attribute of an A element. Recommendations For MacDown version 0.7.1, update to a newer version that contains a fix for...
CVE-2019-12173: Improper Limitation of a Pathname to a Restricted Directory
MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...