EUVD-2026-37027

A flaw was found in GNOME localsearch previously known as tracker-miners MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM Comment tags. An attacker cou...

CVE-2026-1766

A flaw was found in GNOME localsearch previously known as tracker-miners MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM Comment tags. An attacker cou...

SUSE CVE-2026-23952

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL Magick Scripting Language parser when processing tags before images are loaded. This can lead to DoS attack due to...

CVE-2026-23952

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL Magick Scripting Language parser when processing tags before images are loaded. This can lead to DoS attack due to...

CVE-2026-23952

CVE-2026-23952 affects ImageMagick: a NULL pointer dereference in the MSL parser when processing tags before any image loads. Versions 14.10.1 and earlier are vulnerable; the issue can cause a DoS (assertion failure on debug builds or NULL dereference on release builds). A fix exists in version ...

CVE-2026-23952

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL Magick Scripting Language parser when processing tags before images are loaded. This can lead to DoS attack due to...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

Cross Site Scripting (XSS)

antisamy is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper parsing of HTML when the preserveComments directive is enabled in the policy file. This issue can be exploited by an attacker to inject malicious JavaScript via comment tags...

Cross Site Scripting

AntiSamy is vulnerable to Cross Site Scripting. The vulnerability arises due to flawed parsing of the HTML being sanitized. As a result an attacker can execute malicious JavaScript on client side by using certain crafty inputs resulting in elements in comment tags being interpreted as executable...

CVE-2022-31743

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox 101...

CVE-2022-31743: Improper Neutralization of Input During Web Page Generation

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox 101...

Cross-site Scripting (XSS)

firefox is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to a lack of sanitization of HTML comment tags, resulting in an incongruity with other browsers allowing an attacker to inject maliciously crafted script into the system...

Mozilla Firefox Cross-Site Scripting Vulnerability (CNVD-2023-06863)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a cross-site scripting vulnerability that stems from incorrect input validation when handling HTML comment tags. The vulnerability can be exploited by an attacker to launch...

Mozilla Firefox 跨站脚本漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a cross-site scripting vulnerability that stems from incorrect input validation when handling HTML comment tags. The vulnerability can be exploited by an attacker to launch...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775: Improper Neutralization of Input During Web Page Generation

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

PT-2020-20267

Name of the Vulnerable Software and Affected Versions Pega Platform versions prior to 8.2.6 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability in the comment tags. Recommendations For versions prior to 8.2.6, update to version 8.2.6 or later to resolve the issue...

Arbitrary Code Execution

gstreamer-plugins-base is vulnerable to arbitrary code execution. An integer overflow flaw which caused a heap-based buffer overflow was discovered in the Vorbis comment tags reader. An attacker could create a carefully-crafted Vorbis file that would cause an application using GStreamer to crash...