1026 matches found
Plone XSS in User Fullname Property and File Upload
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and...
Credentials transmitted in plain text by OpenShift Deployer Plugin
OpenShift Deployer Plugin stores credentials in its global configuration file org.jenkinsci.plugins.openshift.DeployApplication.xml on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the...
Google Chrome 资源管理错误漏洞
Google Chrome is a web browser from Google, an American company. A memory misreference vulnerability exists in the Messaging component of Google Chrome versions prior to 102.0.5005.61, which arises from a mix-up in the instructions responsible for freeing memory in the Messaging component program...
GHSA-W969-PQ6X-267J INTER-Mediator Cross-Site Scripting (XSS)
Multiple Cross-Site Scripting XSS issues were discovered in INTER-Mediator 5.5. The vulnerabilities exist due to insufficient filtration of user-supplied data c and cred passed to the "INTER-Mediator-master/AuthSupport/PasswordReset/resetpassword.php" URL. An attacker could execute arbitrary HTML...
Design/Logic Flaw
A vulnerability affecting F-Secure SAFE browser was discovered. An attacker can potentially exploit Javascript window.open functionality in SAFE Browser which could lead address bar spoofing attacks...
Elgg Reflected XSS Vulnerability
VULNERABILITY DESCRIPTION The internalname parameter is not properly sanitized, which allows attacker to conduct Cross Site Scripting attack. This may allow an attacker to create a specially crafted URL that would execute arbitrary script code in a victim's browser PROOF-OF-CONCEPT/EXPLOIT http...
Phoenix Arbitrary URL Redirect
The Phoenix team designed Phoenix.Controller.redirect/2 to protect against redirects allowing user input to redirect to an external URL where your application code otherwise assumes a local path redirect. This is why the :to option is used for “local” URL redirects and why you must pass the...
Microsoft Edge browser’s vulnerability, related to improper code generation management, allows attackers to escalate their privileges.
The vulnerability of Microsoft Edge is related to incorrect code generation management. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...
Microsoft Edge browser’s vulnerability, related to improper code generation management, allows attackers to escalate their privileges.
The vulnerability of Microsoft Edge is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to enhance their privileges through a specially created web page...
Google Chrome 安全漏洞
Google Chrome is a web browser from Google, Inc. and V8 is an open source JavaScript engine. A security vulnerability exists in Google Chrome V8 prior to version 100.0.4896.75, which stems from a type confusion issue. A remote attacker can exploit this vulnerability to potentially cause heap...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine exists due to a mix of data types. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Design/Logic Flaw
A vulnerability affecting F-Secure SAFE browser was discovered. A maliciously crafted website attached with USSD code in JavaScript or iFrame can trigger dialer application from F-Secure browser which can be exploited by an attacker to send unwanted USSD messages or perform unwanted calls. In mos...
F-secure F-Secure SAFE 安全漏洞
F-secure F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure F-secure. A security vulnerability exists in the F-Secure SAFE browser, which originates from a maliciously crafted website with USSD code in JavaScript or an iFrame that can trigger a dial-up application fr...
Apple watchOS 安全漏洞
Apple watchOS is an operating system for smartwatches from Apple Inc. in the United States. Apple watchOS 8.5 previously contained a security vulnerability that originated in Apple's browser that could lead to address bar spoofing when visiting a malicious website...
Cross site scripting
A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an attacker to execute the JavaScript can be used to trigger universal cross-site scripting through the browser. User interaction is required...
F-secure F-Secure SAFE 跨站脚本漏洞
F-Secure F-Secure SAFE is a suite of antivirus software from the Finnish company F-Secure F-secure.F-Secure SAFE Browser for Android is vulnerable to cross-site scripting, which can be exploited by attackers to remotely execute JavaScript and trigger generic cross-site scripting through the brows...
CVE-2022-23710
A cross-site-scripting XSS vulnerability was discovered in the Data Preview Pane previously known as Index Pattern Preview Pane which could allow arbitrary JavaScript to be executed in a victim’s browser...
Naver Whale browser 安全漏洞
Naver Whale Browser is a web browser from the Korean company Naver that supports user-defined interfaces. A security vulnerability previously existed in Naver Whale browser 3.12.129.46 that allowed an attacker to corrupt the rendering process, which could lead to taking control of the browser's...
Cross-site Scripting (XSS) - Stored in vanessa219/vditor
Description The Vanessa219/vditor is a markdown editor supported by browsers. When a user creates a link using the markdown syntax, the server does not URL-encode the double-quotes, so the user can escape the href attribute and trigger XSS using the on attribute. Proof of Concept txt XSS PoC : xs...
