CVE-2020-15654: Loop with Unreachable Exit Condition

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. Thi...

Denial Of Service (DoS)

firefox is vulnerable to denial of service. When specifying a custom cursor using CSS in an endless loop, the user interface will be perceived to be in a broken state...

CSS Injection

Overview chartkick is a Ruby gem that allows creation of JavaScript charts. Affected versions of this package are vulnerable to CSS Injection. Chartkick is vulnerable to CSS injection if user input is passed to the width or height option. An attacker can set additional CSS properties, like:...

CSS Injection

chartkick is vulnerable to CSS injection. A remote attacker is able to inject arbitrary CSS without attributes...

VulnCheck KEV: CVE-2020-15654

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. Thi...

CVE-2020-16254

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets CSS Injection without attribute...

CVE-2020-16254

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets CSS Injection without attribute...

CVE-2020-16254

The CVE-2020-16254 entry concerns the Chartkick gem for Ruby, affecting versions up to 3.3.2. The vulnerability is described as CSS Injection (without attribute), with the root cause identified as a CSS injection issue in Chartkick. The provided connected documents consistently reference the same...

CVE-2020-16254

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets CSS Injection without attribute...

CVE-2020-16254

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets CSS Injection without attribute...

PT-2020-14846

Name of the Vulnerable Software and Affected Versions Chartkick gem versions prior to 3.4 Description The issue allows for Cascading Style Sheets CSS Injection without attribute, which can potentially lead to malicious styling or other security issues. Recommendations For versions prior to 3.4,...

CVE-2020-16254: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets CSS Injection without attribute...

CSS injection with width and height options

Chartkick is vulnerable to CSS injection if user input is passed to the width or height option. An attacker can set additional CSS properties, like:...

CVE-2020-11583

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter...

CVE-2020-11583

CVE-2020-11583 affects Plesk Obsidian 18.0.17 with a GET-based reflected XSS. The vulnerability allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. The available connected documents corroborate a client-side data handling flaw in the Plesk Obsidia...

CVE-2020-11583

A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter...

CVE-2020-15654

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. Thi...

CVE-2020-15654

When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user is interacting with the user interface, when they are not. This could lead to a perceived broken state, especially when interactions with existing browser dialogs and warnings do not work. Thi...

CVE-2020-6539

Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

PT-2020-14572

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 78.1 Firefox versions prior to 79 Thunderbird versions prior to 78.1 Description A custom cursor using CSS could make it look like the user is interacting with the user interface when they are not, leading to a...