24 matches found
electronegativity
Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...
tinyxml
/ @mainpage TinyXML TinyXML è un parser XML C++ semplice, piccolo e facilmente integrabile in altri programmi. Cosa fa. In breve, TinyXML analizza un documento XML e ne costruisce un Document Object Model DOM che può essere letto, modificato e salvato. XML sta per "eXtensible Markup Language". Ti...
CVE-2026-54606
SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 3.1.4, the SunEditor Embed plugin in src/plugins/modal/embed.js parses attacker-controlled raw embed HTML with DOMParser and processes the resulting DOM nodes. When an external script eleme...
CVE-2026-68900 Wekan: Stored XSS in HTML board exports through a card-title second parse
Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...
08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +11363 more potentially affected by CVE-2026-41672 via xmldom (>=0.1.2, <=0.5.0)
xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.23, =1.0.0, =0.0.3, =0.0.9 and more Source cves: CVE-2026-41672 Source advisory: OSV:GHSA-J759-J44W-7FR8...
07-calito-router (>=0.0.2, <=0.0.4), @anyauth/design-system (>=0.5.0, <=0.5.1) +13 more potentially affected by CVE-2026-34226 via happy-dom (>=20.0.0, <=20.8.8)
happy-dom NPM version =20.0.0, =0.0.2, =0.5.0, =2.0.0, =1.1.0, =0.0.1-alpha-10, =9.0.0, =0.0.6, =5.50.0, =5.49.5, =0.5.0-rc.2, =0.1.10, =1.1.83, =1.1.92 Source cves: CVE-2026-34226 Source advisory: SNYK:JS-HAPPYDOM-15810980...
Google Chrome < 4.6.85.23 Multiple Vulnerabilities
The version of Google Chrome installed on the remote macOS host is prior to 4.6.85.23. It is, therefore, affected by multiple vulnerabilities as referenced in the 201510stable-channel-update advisory. - Multiple unspecified vulnerabilities in Google Chrome before 46.0.2490.71 allow attackers to...
nuxt-spec (>=0.1.10, <=0.1.11) potentially affected by CVE-2025-62410 via happy-dom (20.0.0)
happy-dom NPM version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on happy-dom and may be impacted: - nuxt-spec =0.1.10, =0.1.11 Source cves: CVE-2025-62410 Source advisory: SNYK:JS-HAPPYDOM-13559227...
SUSE-SU-2025:02289-2 Security update for docker
This update for docker fixes the following issues: Update to Docker 28.2.2-ce bsc1243833, bsc1242114: - CVE-2025-0495: Fixed credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration.bsc1239765 - CVE-2025-22872:...
php: libxml streams use wrong content-type header when requesting a redirected resource
A flaw was found in PHP's DOM and SimpleXML extensions. This vulnerability allows incorrect parsing of a redirected HTTP resource via improper content-type header handling...
AZL-60492 CVE-2025-22872 affecting package ig for versions less than 0.37.0-4
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
AZL-60568 CVE-2025-22872 affecting package multus for versions less than 4.0.2-8
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
Microsoft Internet Explorer 11 Tree::Notify_InvalidateDisplay Null Pointer Dereference
Summary Internet Explorer is a series of graphical web browsers developed by Microsoft and included in the Microsoft Windows line of operating systems, starting in 1995. It was first released as part of the add-on package Plus! for Windows 95 that year. Description The crash is caused due to a NU...
PT-2018-8384 · Red Hat · Jboss Eap
Name of the Vulnerable Software and Affected Versions: JBoss EAP version 7.0 Description: The JAXP implementation used for SAX and DOM parsing in JBoss EAP is susceptible to certain XXE flaws. This could allow an attacker to cause a denial of service, server-side request forgery, or information...
USN-2735-1 oxide-qt vulnerabilities
It was discovered that the DOM tree could be corrupted during parsing in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass same-origin restrictions or cause a denial of service. CVE-2015-1291 An issue was...
Debian Security Advisory DSA 2075-1 (xulrunner)
The remote host is missing an update to xulrunner announced via advisory DSA 2075-1. OpenVAS Vulnerability Test $Id: deb20751.nasl 6614 2017-07-07 12:09:12Z cfischer $ Description: Auto-generated from advisory DSA 2075-1 xulrunner Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...
Debian: Security Advisory (DSA-2075-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-2075-1 : xulrunner - several vulnerabilities
Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2010-0182 Wladimir Palant discovered that security checks in XML processing were insufficiently...