HTML Injection

firefox is vulnerable to HTML injection. Lack of escaping allows an attacker to inject and execute arbitrary HTML in a user's browser when a webpage was viewed in Reader View. While a secure Content Security Policy prevents direct code execution, HTML injection is still possible...

SUSE: Security Advisory (SUSE-SU-2021:0676-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs

Impact The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. Note: Nextcloud Server employs a strict Content Security Policy that mitigates the risk o...

GHSA-G3FQ-3V3G-MH32 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs

Impact The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability. Note: Nextcloud Server employs a strict Content Security Policy that mitigates the risk o...

Stripo Inc: Bypassing Content-Security-Policy leads to open-redirect and iframe xss

Summary: https://my.stripo.email/cabinet//template-editor/..... has the ff: code to make iframes more secure: html pointing to other domains won't work but, the whitelist in frame-src data has listed .firebaseapp.com, a free hosting domain, leading to iframe abuse and redirects Steps To Reproduce...

openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2021:0387-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Error Accessing Citrix Environment Using StoreFront 2.x and HTML5 Receiver 1.3 on Chrome v40 and Later

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users get error when accessing Citrix environment using StoreFront 2.x and HTML5 Receiver 1.3 on...

PT-2021-7320 · Apple +7 · Macos Monterey +12

Name of the Vulnerable Software and Affected Versions: WPE WebKit versions prior to the fixed version iOS versions prior to 15.1 iPadOS versions prior to 15.1 macOS Monterey versions prior to 12.0.1 iOS versions prior to 14.8.1 iPadOS versions prior to 14.8.1 tvOS versions prior to 15.1 watchOS...

The vulnerability of Google Chrome’s Content Security Policy component allows a perpetrator to access confidential data.

The vulnerability of Google Chrome’s Content Security Policy component is related to improper security checks for standard elements. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4756-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4756-1 advisory. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker...

The vulnerability of Google Chrome’s Content Security Policy component allows a perpetrator to access confidential data.

The vulnerability of Google Chrome’s Content Security Policy component is related to the disclosure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data...

The vulnerability of Google Chrome’s Content Security Policy component allows a perpetrator to compromise data integrity.

The vulnerability of Google Chrome’s Content Security Policy component is related to the lack of standard permission mechanisms. Exploiting this vulnerability could allow a malicious actor to compromise data integrity remotely...

Important: thunderbird

Issue Overview: If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affec...

Amazon Linux 2 : thunderbird (ALAS-2021-1618)

The version of thunderbird installed on the remote host is prior to 78.8.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1618 advisory. If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was...

The vulnerability of the Netlify domain controller, related to improperly configured DNS records, allows attackers to intercept cookie files, bypass Content Security Policy (CSP) security policies, Cross-Origin Resource Sharing (CORS) mechanisms, and gain unauthorized access to protected information.

The vulnerability of the Netlify domain controller implementation is related to improperly configured DNS records. Exploiting this vulnerability allows a malicious actor to intercept cookie files, bypass security mechanisms like CSP, Cross-Origin Resource Sharing CORS, and gain unauthorized acces...

CVE-2021-20667

Stored cross-site scripting vulnerability due to inadequate CSP Content Security Policy configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content...

CVE-2021-20667

Stored cross-site scripting vulnerability due to inadequate CSP Content Security Policy configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content...

Cross site scripting

Stored cross-site scripting vulnerability due to inadequate CSP Content Security Policy configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content...

CVE-2021-20667

Stored cross-site scripting vulnerability due to inadequate CSP Content Security Policy configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content...

CVE-2021-20667

Stored cross-site scripting vulnerability due to inadequate CSP Content Security Policy configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content...