318 matches found
PT-2024-20582 · Ckeditor4 +3 · Ckeditor4 +3
Name of the Vulnerable Software and Affected Versions: CKEditor4 versions prior to 4.24.0-lts Description: A cross-site scripting vulnerability has been discovered in the core HTML parsing module of CKEditor4. It may affect all editor instances that enabled full-page editing mode or enabled CDATA...
CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection
Affected packages The vulnerability has been discovered in the core HTML parsing module and may affect all editor instances that: Enabled full-page editing mode, or enabled CDATA elements in Advanced Content Filtering configuration defaults to script and style elements. Impact A potential...
Apache ActiveMQ Unauthenticated Remote Code Execution
This module exploits a deserialization vulnerability in the OpenWire transport unmarshaller in Apache ActiveMQ. Affected versions include 5.18.0 through to 5.18.2, 5.17.0 through to 5.17.5, 5.16.0 through to 5.16.6, and all versions before 5.15.16. Module Options msf use...
Debian dla-3565 : ruby-loofah - security update
The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3565 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3565-1 [email protected]...
CVE-2023-24243
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery SSRF...
CVE-2023-24243
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery SSRF...
CVE-2023-24243
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery SSRF...
Server side request forgery (ssrf)
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery SSRF...
CVE-2023-24243
CVE-2023-24243 : The Nuclei template for CVE-2023-24243 details a Server-Side Request Forgery (SSRF) in CData RSB Connect v22.0.8336 . The vulnerability enables an attacker to trigger the server to make arbitrary outbound requests, with potential for unauthorized access or data leakage as implied...
CVE-2023-24243
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery SSRF...
CVE-2023-24243
CData RSB Connect v22.0.8336 was discovered to contain a Server-Side Request Forgery SSRF...
CData RSB Connect 代码问题漏洞
CData RSB Connect is a connector from CData Corporation. A security vulnerability exists in CData RSB Connect version v22.0.8336 that stems from the inclusion of a server-side request forgery SSRF vulnerability...
PT-2023-19496 · Cdata · Cdata Rsb Connect
Name of the Vulnerable Software and Affected Versions: CData RSB Connect version 22.0.8336 Description: A Server-Side Request Forgery SSRF issue was discovered. This issue allows an attacker to trick the server into making unintended requests, potentially leading to unauthorized access to sensiti...
GHSA-XRQQ-WQH4-5HG2 svg-sanitizer has Cross-site Scripting Bypass
Update In 88 we have determined that the bypass this security advisory was created for, was a false positive and as such we have requested that the CVE be rejected. A bypass has been found that allows an attacker to upload an SVG with persistent XSS. HTML elements within CDATA needed to be...
svg-sanitizer has Cross-site Scripting Bypass
Update In 88 we have determined that the bypass this security advisory was created for, was a false positive and as such we have requested that the CVE be rejected. A bypass has been found that allows an attacker to upload an SVG with persistent XSS. HTML elements within CDATA needed to be...
CVE-2023-28426
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: GHSA-xrqq-wqh4-5hg2. Reason: Further investigation showed that this CVE was assigned in error. Notes: See https://github.com/darylldoyle/svg-sanitizer/issues/88 for a technical discussion...
PT-2023-21712 · Unknown · Svg-Sanitizer
Name of the Vulnerable Software and Affected Versions: savg-sanitizer versions prior to 0.16.0 Description: A bypass has been found in the savg-sanitizer library that allows an attacker to upload an SVG with persistent cross-site scripting. The issue arises from incorrect sanitization of HTML...
SUSE CVE-2009-5065
Cross-site scripting XSS vulnerability in feedparser.py in Universal Feed Parser aka feedparser or python-feedparser before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas...
SUSE CVE-2015-7580
Cross-site scripting XSS vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node...