CVE-2022-0437: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...

Cross-site Scripting (XSS) - DOM in emoncms/emoncms

Description EmonCMS 10.9.19 has a DOM-XSS vulnerability that is executed when javascript code is injected as imported data. Proof of Concept 1 - login into the app and browse to the section Feeds Import Data 2 - add alert1,a or 1638807909,alert2 in the CSV area. Then click on one of the empty fie...

Improper Authorization in openwhyd/openwhyd

Description This Account Takeover via Dom XSS vulnerability occurs because the backend does not check the value of the redirect parameter in the login logic. javascript if form.fbUid userModel.updatedbUser.id, $set: fbId: form.fbUid, fbTok: form.fbTok, // access token provided on last facebook...

CVE-2021-24891: Improper Neutralization of Input During Web Page Generation

The Elementor Website Builder WordPress plugin before 3.4.8 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue...

Adobe: Able to bypass the fix on DOM XSS at [www.adobe.com]

Thank you @saajanbhujel for your contributions and we look forward to collaborating with you again in the future!...

CVE-2021-23041: Improper Neutralization of Input During Web Page Generation

On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before 14.1.4.2, 13.1.x before 13.1.4.1, and all versions of 12.1.x, a DOM based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute...

CVE-2021-37700 Clipboard-based DOM-XSS

@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string , a div is dynamically created, and the clipboard content is copied into its...

Clipboard-based DOM-XSS

Impact A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library. If the clipboard data contains the string , a div is dynamically created, and the clipboard content is copied into its innerHTML property without any sanitization, resulting in improper execution of...

GHSA-GPFJ-4J6G-C4W9 Clipboard-based DOM-XSS

Impact A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library. If the clipboard data contains the string , a div is dynamically created, and the clipboard content is copied into its innerHTML property without any sanitization, resulting in improper execution of...

Adobe: DOM XSS on www.adobe.com

Thank you @saajanbhujel for your contributions and we look forward to collaborating with you again in the future!...

CVE-2021-29209

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

CVE-2021-29208

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

CVE-2021-29210

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

Crlf injection

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

CVE-2021-29209

CVE-2021-29209 affects multiple Hewlett Packard Enterprise products: HPE iLO 4, HPE iLO 5 for Gen10 servers, and related HPE SimpliVity models (380 Gen9/Gen10, 2600, 325, 380 Gen10 H). The vulnerability is a remote DOM XSS with CRLF injection caused by improper input handling during web page gene...

CVE-2021-29208

Summary: CVE-2021-29208 describes a remote DOM-based XSS and CRLF injection affecting multiple Hewlett Packard Enterprise products (notably iLO 4, iLO 5, and related SimpliVity models). The vulnerability arises from improper input handling in web page generation, enabling an attacker to craft pay...

CVE-2021-29210

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

CVE-2021-29210: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

CVE-2021-29208: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

CVE-2021-29209: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...