Prism 跨站脚本漏洞

Prism is an application from the US-based individual developers of Prism. It is a lightweight, extensible syntax highlighting tool. Prism suffers from a cross-site scripting vulnerability that stems from the command line plugin not properly escaping its output, causing input text to be inserted...

CVE-2022-23647: Improper Neutralization of Input During Web Page Generation

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted int...

CVE-2021-43787

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data i.e. javascript into the DOM, theoretically allowing for an account takeover when used in conjunction with a pat...

CVE-2021-43787: Improper Neutralization of Input During Web Page Generation

Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data i.e. javascript into the DOM, theoretically allowing for an account takeover when used in conjunction with a pat...

CVE-2021-39362

An XSS issue was discovered in ReCaptcha Solver 5.7. A response from Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEATHbyCAPTCHA.com, ImageTyperz.com, or BestCaptchaSolver.com in setCaptchaCode is inserted into the DOM as HTML, resulting in full control over the user's browser by these servers...

CVE-2021-39362: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in ReCaptcha Solver 5.7. A response from Anti-Captcha.com, RuCaptcha.com, 2captcha.com, DEATHbyCAPTCHA.com, ImageTyperz.com, or BestCaptchaSolver.com in setCaptchaCode is inserted into the DOM as HTML, resulting in full control over the user's browser by these servers...

ReCaptcha Solver 跨站脚本漏洞

ReCaptcha Solver is a Google application plugin for automated validation of Google ReCaptcha V2. A cross-site scripting vulnerability exists in ReCaptcha Solver version 5.7, which stems from a response in setCaptchaCode being inserted into the DOM as HTML, giving full control over the user's...

Cross-Site Scripting in scratch-svg-renderer

Overview This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function. Recommendation Upgrade to version...

CVE-2020-7750

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function...

CVE-2020-7750

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function...

CVE-2020-7750

CVE-2020-7750 affects the scratch-svg-renderer package prior to 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG content, allowing injection of arbitrary elements into the DOM via _transformMeasurements, which could enable cross-site scripting; the vulnerability is rat...

CVE-2020-7750

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function...

CVE-2020-7750: Improper Neutralization of Input During Web Page Generation

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the transformMeasurements function...

PT-2020-19766

Name of the Vulnerable Software and Affected Versions scratch-svg-renderer versions prior to 0.2.0-prerelease.20201019174008 Description The issue concerns the loadString function, which fails to properly escape SVG. This can lead to the injection of arbitrary elements into the DOM via the...

@anzeblabla/react-native-markdown-editor (>=1.0.3, <=2.1.1), @gorangajic/react-native-markdown (0.1.1) +22 more potentially affected by CVE-2019-9844 via simple-markdown (>=0.0.9, <=0.4.2)

simple-markdown NPM version =0.0.9, =1.0.3, =1.3.0, =1.0.1, =1.0.4, =2.3.0, =0.1.0, =1.2.0, =2.4.0, =1.2.0, =1.1.0, =1.0.0, =1.10.0 and more Source cves: CVE-2019-9844 Source advisory: OSV:GHSA-QJ3F-9GMQ-FWV5...

PT-2018-15551

Name of the Vulnerable Software and Affected Versions SAP Hana Database versions 1.00 through 2.00 SAP UI5 version 1.00 SAP UI5 Java versions 7.30 through 7.50 SAP UI versions 7.40 through 7.52 SAP UI for SAP NetWeaver version 2.0 Description The issue arises from the failure to validate user inp...

CVE-2016-10547

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting XSS vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as name=alert1, it is possible to...

PT-2018-4725

Name of the Vulnerable Software and Affected Versions Nunjucks versions 2.4.2 and lower Description The issue concerns a cross-site scripting vulnerability in autoescape mode. Normally, all template variables should be automatically escaped in this mode. However, by using an array for the keys,...

Sonatype Nexus Repository Manager OSS/Pro 2.14.5 / 3.7.1 XSS

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Cross-Site Scripting Vulnerabilities product: Sonatype Nexus Repository Manager OSS/Pro vulnerable version: =2.14.5, =3.7.1 fixed version: 2.14.6, 3.8.0 CVE...

Pivotal Single Sign-On for PCF Cross-Site Scripting Vulnerability

Pivotal Single Sign-On for PCF is a suite of single sign-on security access tools for PCFs from Pivotal Software, USA. A security vulnerability exists in Pivotal Single Sign-On for PCF versions 1.3.x prior to 1.3.4 and 1.4.x prior to 1.4.3. An attacker can exploit the vulnerability by injecting...