CVE-2022-31108

Summary of CVE-2022-31108 (mermaid.js) : The vulnerability allows an attacker to inject arbitrary CSS into the generated graph, enabling styling changes to elements outside the SVG and potential information disclosure via CSS selectors that trigger HTTP requests. The issue is tied to how user inp...

CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

CVE-2022-31108

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

Denial Of Service (DoS)

lettersanitizer is vulnerable to denial of service. The vulnerability exists in the sanitizeHtml function in index.js as it does not properly handle css at-rules, allowing an attacker to crash the system via a malicious request...

MantisBT < 2.25.5 Multiple Vulnerabilities - Windows

MantisBT is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

MantisBT < 2.25.5 Multiple Vulnerabilities - Linux

MantisBT is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security Vulnerabilities fixed in Thunderbird 91.11 and Thunderbird 102 — Mozilla

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. This bug only affects Thunderbird for Linux. Other operating systems are unaffected. Session history navigations m...

CVE-2022-31103

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

Denial of service

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

CVE-2022-31103 Improper handling of CSS at-rules in lettersanitizer

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

CVE-2022-31103

Lettersanitizer is a DOM-based HTML email sanitizer. All versions below 1.0.2 are affected by a denial-of-service when processing the CSS at-rule @keyframes. The issue also affects React Letter via dependency on lettersanitizer. Root cause: improper handling of CSS at-rules in the sanitizer, lead...

urologie.slingeland.nl Cross Site Scripting vulnerability OBB-2681957

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Improper handling of CSS at-rules in lettersanitizer

Impact All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is also at risk. Patches The problem has been patched in version 1.0.2...

GHSA-7R3R-GQ8P-V9JJ Improper handling of CSS at-rules in lettersanitizer

Impact All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is also at risk. Patches The problem has been patched in version 1.0.2...

Malicious code in base-css-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f81c6f392029b9702f5a17b445a87e8a4378d5931d872e0755c58ae4c55ea005 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1465 Malicious code in base-css-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f81c6f392029b9702f5a17b445a87e8a4378d5931d872e0755c58ae4c55ea005 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7219 Malicious code in wordpress-core-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da64c82d79dc32b8d356985ee58045d432733c7b1b8d0eb737dcaa34e447d4dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wordpress-core-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da64c82d79dc32b8d356985ee58045d432733c7b1b8d0eb737dcaa34e447d4dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...