RSSHub Cross-Site Scripting Vulnerability

RSSHub is an RSS feed generator written in Node.js, distributed under the MIT license and maintained by DIYgod and other GitHub users. A cross-site scripting vulnerability exists in RSSHub. An attacker can exploit this vulnerability to execute arbitrary JavaScript code...

CVE-2023-26486: Improper Neutralization of Input During Web Page Generation

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. The Vega scale expression function has the ability to call arbitrary functions with a single controlled argument. The scale expression function passes a user supplied argumen...

CVE-2023-26046

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version 0.1.1 is vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute...

rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters

Impact When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. Patches This vulnerability was...

Cross-Site Scripting (XSS)

@toast-ui/chart is vulnerable to Cross-Site Scripting XSS. The vulnerability exists because the renderTooltip function in tooltip.ts does not properly sanitize the legend fields which allows an attacker to inject and execute arbitrary JavaScript into the browser...

CVE-2023-24810

Misskey is an open source, decentralized social media platform. Due to insufficient validation of the redirect URL during "miauth" authentication in Misskey, arbitrary JavaScript can be executed when a user allows the link. All versions below 13.3.1 including 12.x are affected. This has been fixe...

CVE-2023-25154

Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a javascript scheme an attacker may execut...

CVE-2023-24811

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross site scripting vulnerability due to insufficient URL validation. Arbitrary JavaScript is executed when a malicious URL is loaded in the "View in Player" or...

Misskey cross-site scripting vulnerability

Misskey is a set of micro-blogging platform. A cross-site scripting vulnerability exists in versions prior to Misskey 13.3.2, which stems from insufficient validation of URLs and a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary JavaScript...

K75532331: iRulesLX debug NodeJS vulnerability CVE-2019-6644

Security Advisory Description Similar to the issue identified in CVE-2018-12120, the BIG-IP system will bind a debug nodejs process to all interfaces when invoked. This may expose the process to unauthorized users if the plugin is left in debug mode and the port is accessible. CVE-2019-6644 Impac...

K37111863: NodeJS vulnerability CVE-2018-12120

Security Advisory Description Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the...

CVE-2023-22984

A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL...

CVE-2023-22984

A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL...

Cross site scripting

UNSUPPORTED WHEN ASSIGNED A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL...

CVE-2023-22984: Improper Neutralization of Input During Web Page Generation

A Vulnerability was discovered in Axis 207W network camera. There is a reflected XSS vulnerability in the web administration portal, which allows an attacker to execute arbitrary JavaScript via URL...

iziModal Cross-Site Scripting Vulnerability

iziModal is an elegant, responsive, flexible and lightweight jQuery modal plugin. A security vulnerability exists in iziModal versions prior to 1.6.1, which stems from a cross-site scripting XSS attack when handling untrusted modal headers, and can be exploited to execute arbitrary HTML or...

PT-2023-18810 · Axis · Axis 207W

Name of the Vulnerable Software and Affected Versions: Axis 207W network camera affected versions not specified Description: A reflected XSS issue in the web administration portal of the Axis 207W network camera allows an attacker to execute arbitrary JavaScript via URL. This enables the attacker...

SUSE CVE-2008-5512

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with chrome privileges via unknown vectors in which "page content can pollute...

SUSE CVE-2012-3965

Mozilla Firefox before 15.0 does not properly restrict navigation to the about:newtab page, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers creation of a new tab and then a new window...

SUSE CVE-2012-4193

Mozilla Firefox before 16.0.1, Firefox ESR 10.x before 10.0.9, Thunderbird before 16.0.1, Thunderbird ESR 10.x before 10.0.9, and SeaMonkey before 2.13.1 omit a security check in the defaultValue function during the unwrapping of security wrappers, which allows remote attackers to bypass the Same...