CVE-2022-45472

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

Design/Logic Flaw

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

CVE-2022-45472

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

CVE-2022-45472

CVE-2022-45472 affects CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639. The vulnerability is DOM-based XSS triggered by ontouchmove and onpointerup, allowing injection of script and potential UI/data impact. Root cause relates to insufficient input filtering/escaping of u...

CVE-2022-45472

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

Cross site scripting vulnerability with discussion titles

Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title input, either by creating a new discussion or...

Cross-site Scripting (XSS)

flarum is vulnerable to cross-site scripting XSS. The library's page title system enables page titles to be converted into HTML DOM nodes when pages are rendered, which allows an attacker to inject malicious HTML markup using a discussion title input when a visitor opens the relevant discussion...

CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title inpu...

CVE-2022-41938 Cross site scripting vulnerability with discussion titles in flarum

Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered. The change was made after v1.5 and was not noticed. This allowed an attacker to inject malicious HTML markup using a discussion title inpu...

prismjs: improperly escaped output allows a XSS

A Cross-site scripting attack was found in Prism. The command-line plugin did not properly escape its output. This issue leads to the input text being inserted into the Document Object Model DOM as HTML code, which can be exploited by an attacker...

CVE-2022-42960

EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...

Input validation

EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...

CVE-2022-42960

EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...

CVE-2022-42960

CVE-2022-42960 concerns the EqualWeb Accessibility Widget. The connected sources confirm a DOM XSS vulnerability in the widget due to improper validation of message events within accessibility.js. Affected versions include 2.0.0 through 4.0.1 (exact sub-versions listed in the public records). The...

CVE-2022-42960

EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...

dom-home.me Cross Site Scripting vulnerability OBB-3056995

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 37 Update: libxml2-2.10.3-2.fc37

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

New Vulnerability in Popular Widget Shows Risks of Third-Party Code

UPDATE: Snyk has recently addressed 2 additional vulnerabilities we have reported to them, CVE-2022-24441 and CVE-2022-22984, affecting versions of Snyk CLI before XXX, which leads to arbitrary code execution when scanning untrusted Maven or Gradle projects. Similar to CVE-2022-40764 these...

Uber: DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ]

Vulnerability description not provided...

Urlscan.io API Inadvertently Leaked Sensitive Data and URLs

By Deeba Ahmed Urlscan.io is a website scanning and analyzing engine that accepts URL submissions and creates a trove of data such as IPs, domains, DOM information, screenshots, and cookies. This is a post from HackRead.com Read the original post: Urlscan.io API Inadvertently Leaked Sensitive Dat...