6220 matches found
CVE-2019-7316
CVE-2019-7316 concerns CSS-TRICKS Chat2 (up to 2015-05-05). The issue is a SQL injection in the userid parameter of jumpin.php, exposing a vulnerability in input handling. The CVSS indicates high to critical impact: network attack vector, no authentication, and partial to high impact on confident...
BEEMKA: Basic Electron Post-Exploitation Framework
PenTestIT RSS Feed There are a lot of applications today that use Electron Framework, as it helps you build cross platform desktop apps with JavaScript, HTML, and CSS. Examples are applications such as Skype, Station, etc. A new post-exploitation framework - BEEMKA can now help you in maintaining...
KLA11411 Multiple vulnerabilities in Mozilla Thunderbird
Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: Use-after-free vulnerability can be exploited remotely via specially designed HTML5...
KLA11408 Multiple vulnerabilities in Apple iTunes
Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code, perform cross-site scripting attack. Below is a complete list of vulnerabilities: 1. A memory corruption vulnerability i...
Cross-Site Scripting in Bootstrap CSS toolkit
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-006...
Cross-Site Scripting in Bootstrap CSS toolkit
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-006...
Cross-Site Scripting in Bootstrap CSS toolkit
It has been discovered that the third party library Bootstrap CSS toolkit is vulnerable to cross-site scripting. Details are mentioned in a dedicated vulnerability report at...
Denial Of Service (DoS)
kdelibs is vulnerable to denial of service. The CSS parser DOM implementation does not properly parse the location of the source for a font face, allowing a remote attacker to crash the application or potentially execute arbitary code by loading a malicious web page that results in a heap-based...
Cross-site Scripting (XSS)
The sanitizecss method in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle newline characters, which makes it easier for remote attackers to condu...
CVE-2018-6164
Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6137
CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6137
CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
Design/Logic Flaw
CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
UBUNTU-CVE-2018-6137
CSS Paint API in Blink in Google Chrome prior to 67.0.3396.62 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
Input validation
Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6164
Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
UBUNTU-CVE-2018-6164
Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6164
Insufficient origin checks for CSS content in Blink in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2018-6137
CVE-2018-6137 is a Blink information-leak vulnerability in Google Chrome, present in Blink-based builds prior to 67.0.3396.62. A crafted HTML page could allow a remote attacker to disclose cross-origin data. Connected CNVD-2018-11487 describes the Chrome/Blink impact and mode of disclosure. Publi...