1324 matches found
CVE-2022-0437
Cross-site Scripting XSS - DOM in NPM karma prior to 6.3.14...
Cross-site Scripting (XSS)
Overview materialize-css is a CSS Framework based on Material Design. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper escape of user input such as not-a-tag / that is being parsed as HTML/JavaScript, and inserted into the Document Object Model DOM. Thi...
Vulnerability of software programs with DOM functions to bypass CAPTCHA; ReCaptcha solvers that allow hackers to gain full control over the browser.
The vulnerability of DOM-based software for bypassing CAPTCHA systems is related to the lack of security measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a hacker to gain full control over the browser...
The vulnerability of the Mozilla Firefox browser, related to information representation errors, allows attackers to perform spear-phishing attacks.
The vulnerability of the Mozilla Firefox browser is related to errors in the object model representation of documents. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...
PT-2021-3711
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 90 Description The issue is related to errors in the representation of information in the Document Object Model DOM. It allows an attacker to overlay a message, which they control the text of, on top of another domain...
DEBIAN-CVE-2021-33813
An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request...
OESA-2021-1222 libxml2 security update
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...
CVE-2017-17678
BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting XSS. A DOM-based cross-site scripting vulnerability was discovered in a legacy utility...
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...
Dart 跨站脚本漏洞
Dart is an open source programming language. A cross-site scripting vulnerability exists in Dart SDK versions prior to 2.12.3, which can be exploited by attackers to use XSS attacks by hitting the DOM hard...
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...
Rocket.Chat: Blind XSS
Blind XSS The page located at https://livechat.coinflex.com/livechat suffers from a Cross-site Scripting XSS vulnerability. XSS is a vulnerability which occurs when user input is unsafely encorporated into the HTML markup inside of a webpage. When not properly escaped an attacker can inject...
The vulnerability of Firefox, Firefox ESR, and the Thunderbird email client relates to the issue of operations beyond the buffer boundaries in memory when manipulating the DOM tree. This allows an attacker to execute arbitrary code.
The vulnerability of Firefox browsers, Firefox ESR, and the email client Thunderbird is related to the issue of operations going beyond the buffer in memory when manipulating the DOM tree. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created...
Insulet Corporation: DOM XSS on www.omnipod.com/freedom/birthdate-confirmation and www.omnipod.com/pif/thanks-freedom
The DOM-based XSS vulnerability was found on the www.omnipod.com/freedom/birthdate-confirmation and www.omnipod.com/pif/thanks-freedom pages. The vulnerability was triggered by crafting a URL with malicious code in the query parameters, which was then executed by the vulnerable script on the page...
The vulnerability of Firefox, Firefox ESR, and the Thunderbird email client relates to the use of memory after element manipulation in the DOM. This allows an attacker to trigger a service failure.
The vulnerability of Firefox browsers, Firefox ESR, and the email client Thunderbird relates to the use of memory after element manipulation in the DOM is released. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
CVE-2020-7809
ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...
CVE-2020-7809
ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...
CVE-2020-5334
RSA Archer, versions prior to 6.7 P2 6.7.0.2, contains a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM...
Criminals hack Tupperware website with credit card skimmer
Update 2: A spokesperson for Tupperware has given a public statement to Alex Scroxton, Security Editor at ComputerWeekly. You can read it here. Update: Following our blog post, we continued to monitor the Tupperware website. As of 03/25 at 1:45 PM PT, we noticed that the malicious PNG file had be...