2493 matches found
CVE-2025-59332 3DAlloy allows stored XSS through attributes provided to the 3d parser tag/function
3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the parser tag and the 3d parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that...
3DAlloy 跨站脚本漏洞
3DAlloy is a lightweight 3D viewer from the individual developer Maxim Martynov. A cross-site scripting vulnerability exists in 3DAlloy 1.8 and earlier versions, which stems from not cleaning up a custom attribute on the canvas HTML element and could lead to the execution of arbitrary JavaScript...
CVE-2025-59332: Improper Neutralization of Input During Web Page Generation
3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the parser tag and the 3d parser function allow users to provide custom attributes that are then appended to the canvas HTML element that is being output by the extension. The attributes are not sanitized, which means that...
PT-2025-37757
Name of the Vulnerable Software and Affected Versions: 3DAlloy versions 1.0 through 1.8 Description: 3DAlloy is a lightWeight 3D-viewer for MediaWiki. The parser tag and the 3d parser function do not sanitize user-provided attributes, allowing arbitrary JavaScript to be inserted and executed when...
Linux Distros Unpatched Vulnerability : CVE-2015-5788
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vecto...
Linux Distros Unpatched Vulnerability : CVE-2016-1859
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The WebKit Canvas implementation in Apple iOS before 9.3.2, Safari before 9.1.1, and tvOS before 9.2.1 allows remote attackers to execute arbitrary code or caus...
The vulnerability of the ANGLE library in Google Chrome browser allows a hacker to execute arbitrary code.
The vulnerability of the ANGLE library in Google Chrome browsers relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code through specially crafted WebGL or Canvas operations...
Important: Red Hat Security Advisory: thunderbird security update
An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component
A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: Canvas2D component...
Important: Red Hat Security Advisory: thunderbird security update
An update for thunderbird is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component
A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: Canvas2D component...
RHEL 8 : firefox (RHSA-2025:15418)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:15418 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...
Important: firefox
Issue Overview: Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2. CVE-2025-6703 An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also...
Amazon Linux 2023 : firefox (ALAS2023-2025-1171)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1171 advisory. Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2. CVE-2025-6703 An attacker was able to perform memo...
MGASA-2025-0228 Updated thunderbird packages fix vulnerabilities
Use-after-free in FontFaceSet. CVE-2025-6424 The WebCompat WebExtension shipped exposed a persistent UUID. CVE-2025-6425 Incorrect parsing of URLs could have allowed embedding of youtube.com. CVE-2025-6429 Content-Disposition header ignored when a file is included in an embed or object tag...
OESA-2025-2154 gnuplot security update
Gnuplot is a portable command-line driven graphing utility for Linux, OS/2, MS Windows, OSX, VMS, and many other platforms. The source code is copyrighted but freely distributed i.e., you don't have to pay for it. It was originally created to allow scientists and students to visualize mathematica...
OESA-2025-2096 firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global mozdebugprefix /lib/debug %global mozdebugdir /lib/debug/ %global unamem %uname -m %global symbolsfilename -.en-US.-%uname.crashreporter-symbols.zip %global symbolsfilepath...
RHEL 10 : thunderbird (RHSA-2025:14844)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:14844 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Denial-of-service due to out-of-memor...
