EulerOS 2.0 SP9 : golang (EulerOS-SA-2023-2613)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/'...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2023-2583)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/'...

PT-2023-26990 · Unknown · Social Media Skeleton

Name of the Vulnerable Software and Affected Versions: social-media-skeleton versions 1.0.0 through 1.0.3 Description: The issue is a stored cross-site scripting vulnerability in an uncompleted social media project implemented using PHP, MySQL, CSS, JavaScript, and HTML. Recommendations: For...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2023-2613)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in misk-tailwind-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 567443deccb6eabc476eeb33858fd2ea51f98ab82ab3a814e02bacda56979a09 The OpenSSF Package Analysis project identified 'misk-tailwind-css' @ 1.0.3 npm as malicious. It is considered malicious because: - The package...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2023:0193-1 Rating: important References: 1213462 Cross-References: CVE-2023-3727 CVE-2023-3728 CVE-2023-3730 CVE-2023-3732 CVE-2023-3733 CVE-2023-3734 CVE-2023-3735 CVE-2023-3736 CVE-2023-3737 CVE-2023-3738...

WordPress Instant CSS Plugin <= 1.1.4 is vulnerable to Broken Access Control

Software Instant CSS Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-38483 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 847cf82f9a4b Credits Abdi Pranata Required privilege...

golang: html/template: improper sanitization of CSS values

A flaw was found in golang where angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if...

CVE-2023-32965

Unauth. Reflected Cross-Site Scripting XSS vulnerability in CRUDLab Jazz Popups plugin = 1.8.7 versions...

www2a.biglobe.ne.jp Cross Site Scripting vulnerability OBB-3523251

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

KLA50770 Multiple vulnerabilities in Microsoft Dynamics

Multiple vulnerabilities were found in Microsoft Dynamics. Malicious users can exploit these vulnerabilities to spoof user interface. Below is a complete list of vulnerabilities: 1. A cross-site-scripting XSS vulnerability Microsoft Dynamics 365 on-premises can be exploited remotely to spoof user...

golang: html/template: improper sanitization of CSS values

A flaw was found in golang where angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if...

feelunique.fr Cross Site Scripting vulnerability OBB-3493337

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

Impact Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize = 3.0.0, = 6.0.2 performs additional escaping of CSS in style element content, which fixes this issue. Workarounds Users who are unable to upgrade can prevent this issue by using a...

GHSA-F5WW-CQ3M-Q3G7 Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

Impact Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize = 3.0.0, = 6.0.2 performs additional escaping of CSS in style element content, which fixes this issue. Workarounds Users who are unable to upgrade can prevent this issue by using a...

CVE-2023-36823

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a...

DEBIAN-CVE-2023-36823

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a...

UBUNTU-CVE-2023-36823

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a...

Cross site scripting

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a...

CVE-2023-36823

CVE-2023-36823 affects the Ruby sanitizer library (Sanitize). Older releases (3.0.0–6.0.1) could allow crafted HTML/CSS to bypass allowlisting when using the built-in relaxed config or a custom config permitting style elements and CSS at‑rules, enabling cross‑site scripting. Sanitize 6.0.2 fixes ...