PT-2023-16398 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.2 Description: The issue is related to Cross-site Scripting XSS - DOM, which allows an attacker to execute malicious scripts in the browser. This can lead to unauthorized access to sensitive...

CVE-2022-23475 dalorRadius full account take over

daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting XSS and cross site request forgery CSRF vulnerability which leads to account takeover in the mng-del.php file because of an unescaped variable reflected in...

UBUNTU-CVE-2022-3873

Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...

CVE-2022-0542

Cross-site Scripting XSS - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0...

CVE-2022-0602

Cross-site Scripting XSS - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0...

Karma 跨站脚本漏洞

Karma is a simple tool. Allows JavaScript code to be executed in multiple real browsers. karma has a cross-site scripting vulnerability that stems from the DOM in NPM karma. no details of the vulnerability are currently available...

Acronis: XSS on https://partners.acronis.com/

Hello, I found DOM XSS on login page of https://partners.acronis.com/ Open this URL https://partners.acronis.com/en-us/profile/login.html?-back=test123" and search for var back =. Here input is HTML encoded but from that reflected value, element is created and appended to the form. F983552 We can...

@anujboddu/searchbar (>=2.0.0 <=2.1.1), @dlghq/dialog-components (>=0.146.0 <=0.149.7) +42 more potentially affected by CVE-2018-6341 via react-dom (>=16.1.0 <=16.1.1)

react-dom NPM version =16.1.0, =2.0.0, =0.146.0, =4.0.1, =0.0.7, =1.0.0, =1.0.0, =1.1.0, =1.3.9, =1.1.10, =1.0.6, =0.0.12, =0.1.0, =3.6.3, =3.7.4 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

@amory/patch-gatsby (>=2018.4.29-8 <=2018.5.11-5), @amory/patches (>=2018.5.11-6 <=2018.5.23-7) +226 more potentially affected by CVE-2018-6341 via react-dom (>=16.3.0 <=16.3.2)

react-dom NPM version =16.3.0, =2018.4.29-8, =2018.5.11-6, =2.0.0-rc.2, =0.0.5, =0.0.1, =1.9.1, =1.3.2, =1.6.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.3.2, =1.1.0, =1.1.3 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

@akiolabs/analytics (>=0.0.3 <=0.0.4), @akiolabs/app (>=0.0.2 <=0.0.4) +221 more potentially affected by CVE-2018-6341 via react-dom (>=16.4.0 <=16.4.1)

react-dom NPM version =16.4.0, =0.0.3, =0.0.2, =0.0.1, =2018.5.24-0, =2018.6.17-2, =2018.7.11-0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.0-beta.0, =0.0.2, =0.0.22-alpha.1, =1.1.0, =1.0.0, =1.6.1 and more Source cves: CVE-2018-6341 Source advisory: OSV:GHSA-MVJJ-GQQ2-P4HW...

Google Chrome DOM Homology Policy Bypass Vulnerability (CNVD-2015-07958)

Google Chrome is a web browser developed by the American company Google Google. A security vulnerability exists in the DOM implementation of Google Chrome versions prior to 47.0.2526.73. A remote attacker can exploit the vulnerability to bypass the same-origin policy...

UBUNTU-CVE-2015-6768

The DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-6770...

chromium-browser: Use-after-free in DOM

Use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in WebKit/Source/core/dom/ContainerNode.cpp in the DOM implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via...

WordPress Syndication Links Plugin <= 1.0.2 - Cross Site Scripting

This plugin is prone to a DOM cross site scripting vulnerability. This attack is executed as a result of modifying the DOM in the victim’s browser used by the original client side script. Solution Update the plugin...

chromium-browser: use-after-free in DOM

Use-after-free vulnerability in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unexpected absence of document data structures...

Google Chrome DOM memory misreference vulnerability (CNVD-2015-00701)

Google Chrome is a simple and efficiently designed web browsing tool developed by Google. A memory misreference vulnerability in the Element::detach function in the Google Chrome DOM implementation core/dom/Element.cpp allows an attacker to construct a malicious WEB page and trick a user into...

Code injection

Unspecified vulnerability in the DOM implementation in Opera before 11.50 allows remote attackers to cause a denial of service application crash via unknown content on a web page, as demonstrated by live.com...

PT-2011-2285 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 through 8 Description: The issue allows remote attackers to execute arbitrary code or cause a denial of service via vectors related to the DOM implementation. An attacker could exploit this by constructi...