SUSE CVE-2017-7814

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise ...

DEBIAN-CVE-2022-23518

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions = 1.0.3, = 2.1.0. This issue is patched in version 1.4.4...

UBUNTU-CVE-2022-23518

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions = 1.0.3, = 2.1.0. This issue is patched in version 1.4.4...

nodejs-normalize-url: ReDoS for data URLs

A flaw was found in normalize-url. Node.js has a ReDoS regular expression denial of service issue because it has exponential performance for data...

UBUNTU-CVE-2021-43818

lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant...

IBM Planning Analytics 代码问题漏洞

IBM Planning Analytics is a planning, budgeting, forecasting and analytics solution. A server-side request forgery vulnerability exists in IBM Planning Analytics 2.0. An attacker could exploit this vulnerability by making arbitrary requests to the internal network or local file system from a...

CVE-2021-27671

An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive, allowing for example Data: to be used in an attack...

PT-2020-12310

Name of the Vulnerable Software and Affected Versions Keycloak version 10.0.1 Description A flaw in the data filter of Keycloak allows the processing of data URLs under certain circumstances, enabling an attacker to conduct cross-site scripting or further attacks. Recommendations For version...

Security update for grafana, grafana-piechart-panel, grafana-status-panel (moderate)

openSUSE Security Update: Security update for grafana, grafana-piechart-panel, grafana-status-panel Announcement ID: openSUSE-SU-2020:0892-1 Rating: moderate References: 1170557 Cross-References: CVE-2019-15043 CVE-2020-12245 CVE-2020-13379 Affected Products: openSUSE Leap 15.2 An update that fix...

CVE-2018-5142

If Media Capture and Streams API permission is requested from documents with "data:" or "blob:" URLs, the permission notifications do not properly display the originating domain. The notification states "Unknown protocol" as the requestee, leading to user confusion about which site is asking for...

Mozilla: Blob and data URLs bypass phishing and malware protection warnings (MFSA 2017-22)

File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of suspicious sites and files. This would allow malicious sites to lure users into downloading executables that would otherwise ...

CVE-2016-6845

An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. Script code within hyperlinks at HTML E-Mails is not getting correctly sanitized when using base64 encoded "data" resources. This allows an attacker to provide hyperlinks that may execute script code instead of directing to a...

Mozilla: Add-on notification bypass through data URLs (MFSA 2015-95)

A flaw was found in the way Firefox handled installation of add-ons. An attacker could use this flaw to bypass the add-on installation prompt, and trick the user into installing an add-on from a malicious source...

Spy Agencies Hijack Google Play Store to Install Spyware on Smartphones

I have an Android phone with a five different gmail accounts configured in it. But what if any one of them get compromised via phishing, malware or any other way? The Hacker would be able to access my Google account and obviously Google Play Store account too, which allows anyone to install any...