Rocket.Chat: Content-Security Policy bypass with File Uploads

The default Content-Security Policy CSP in Rocket.Chat versions 4.0.3 and 3.18.2 was bypassed by uploading a JavaScript file through the file upload feature. This file could then be included in the web application, allowing the execution of arbitrary scripts...

XSS in Contacts

None...

XSS in Talk

None...

Google Chrome Blink improperly implemented vulnerability (CNVD-2021-84806)

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 95.0.4638.54 are vulnerable to an improper Blink implementation. An attacker could exploit this vulnerability to abuse content security policies via crafted HTML pages...

Google Chrome 安全特征问题漏洞

Chrome is a web browsing tool developed by Google. versions prior to Google Chrome 95.0.4638.54 are vulnerable to an improper Blink implementation. An attacker could exploit this vulnerability to abuse content security policies via crafted HTML pages...

OPENSUSE-SU-2021:3353-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.32.4 - CVE-2021-30858: Fixed a security bug that could allow maliciously crafted web content to achieve arbitrary code execution. bsc1190701 - CVE-2021-21806: Fixed an exploitable use-after-free vulnerability via...

Discourse 2.8.0.beta6 < 2.9.0.beta5 XSS Vulnerability

Discourse is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2021-41095

Discourse is an open source discussion platform. There is a cross-site scripting XSS vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error...

Cross site scripting

Discourse is an open source discussion platform. There is a cross-site scripting XSS vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error...

CVE-2021-41095

CVE-2021-41095 affects Discourse: XSS in error messages that reflect user input, triggered only when a site blocks watched HTML-tag words and the default Content Security Policy is modified. Affected versions include Discourse stable ≤2.7.7, beta ≤2.8.0.beta6, and tests-passed ≤2.8.0.beta6. Root ...

CVE-2021-41095 XSS via blocked watched word in error message

Discourse is an open source discussion platform. There is a cross-site scripting XSS vulnerability in versions 2.7.7 and earlier of the stable branch, versions 2.8.0.beta6 and earlier of the beta branch, and versions 2.8.0.beta6 and earlier of the tests-passed branch. Rendering of some error...

Mail.ru: XSS Stored on https://seedr.ru

Site: https://seedr.ru/ OS version: Windows 10 browser: Google chrome Stored cross-site scripting arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. I changed my nickname to a code that demonstrates the...

CVE-2021-37860

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP...

PT-2021-21892 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 5.38 and earlier Description: The issue is related to insufficient sanitization of clipboard contents, allowing a user-assisted attacker to inject arbitrary web script in product deployments where the default Content...

Mattermost 跨站脚本漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. A security vulnerability exists in Mattermost 5.38 and earlier versions, which stems from the application's failure to adequately clean up clipboard content and could be exploited to inject arbitrary Web scripts into produc...

U.S. Dept Of Defense: Subdomain takeover [​████████]

The subdomain ███████ was pointing to an Azure Cloud App domain araz-sp.centralus.cloudapp.azure.com, but that endpoint was not registered. Impact It's extremely vulnerable to attacks as a malicious user could create any web page with any content and host it on the vulnerable domain. This would...

Insufficient Policy Enforcement

Insufficient policy enforcement in Blink in Google Chrome. It allowed a remote attacker to bypass content security policy via a crafted HTML page...

Nextcloud Circles Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Nextcloud Circles, an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud Germany, which stems from the failure of the product's Content-Security-Policy to properly handle incoming input data in...

CVE-2021-30749

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2021-32782

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting XSS vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitab...