WooCommerce < 4.2.1 - Potential Cross-Site Scripting (XSS) via SelectWoo

A DOM based Cross-Site Scripting XSS vulnerability was found to affect the SelectWoo dependency that WooCommerce used. SelectWoo replaces the standard box in web browsers...

EulerOS 2.0 SP2 : xerces-c (EulerOS-SA-2020-1640)

According to the version of the xerces-c package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not be...

CVE-2020-9647

Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting dom-based vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser...

Cross site scripting

Adobe Experience Manager versions 6.5 and earlier have a cross-site scripting dom-based vulnerability. Successful exploitation could lead to arbitrary javascript execution in the browser...

CVE-2020-9647

CVE-2020-9647 affects Adobe Experience Manager versions 6.5 and earlier, with a DOM-based cross-site scripting vulnerability that could lead to arbitrary JavaScript execution in the browser. Connected sources confirm the affected product and the vulnerability class; no exploitation details are pr...

Joomla 2.5.x < 3.9.19 Multiple Vulnerabilities (5812-joomla-3-9-19)

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.19. It is, therefore, affected by multiple vulnerabilities. - In Joomla! before 3.9.19, lack of input validation in the heading tag option of the Articles - Newsflash and Article...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS. XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to JQLite methods like JQLite.prepend, JQLite.after, JQLite.append, JQLite.replaceWith,...

8x8: DOM Based XSS at docs.8x8.com

A domain for marketing documentation contained a DOM based XSS due to evaluation and rendering of window.location.href in the related javascript...

Use of insecure jQuery version in OctoberCMS

Impact Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. Patches Issue has been patched in Build 466 v1.0.466 by applying the recommended patch from @jquery. Workarounds Apply...

Exploit for Cross-site Scripting in Bludit

Author: Andre k Lorenci Contact: [email protected] CVE-2020-1...

Open Redirection

mediawiki is vulnerable to open redirection. Having duplicate DOM query in the resources/src/mediawiki.page.ready/ready.js on a logout click allows an attacker to force a logout and external redirection of the usere using HTML content in a MediaWiki page...

Urban Dictionary: DOM XSS through ads

Multiple ads hosted on www.urbandictionary.com make the www.urbandictionary.com origin vulnerable to DOM XSS. Attached is an image of alertdocument.domain executing. The injection works in Firefox and Chrome. Visiting the following URL will probably cause an alert box displaying the document.doma...

NewStart CGSL CORE 5.04 / MAIN 5.04 : xerces-c Vulnerability (NS-SA-2020-0028)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has xerces-c packages installed that are affected by a vulnerability: - The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been...

FreeBSD : drupal -- Multiple Vulnerabilities (c5ec57a9-9c2b-11ea-82b8-4c72b94353b5)

Drupal Security Team reports : The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are: ... Security issues in jQuerys DOM manipulation methods, as in .html, .append, and the...

Xiaomi: DOM-based XSS in d.miwifi.com on IE 11

There is a DOM based XSS on d.miwifi.com but it only works on IE 11...

Drupal 7.0.x < 7.70 / 7.0.x < 7.70 / 8.7.x < 8.7.14 / 8.8.x < 8.8.6 Multiple Vulnerabilities (drupal-2020-05-20)

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.70, 7.0.x prior to 7.70, 8.7.x prior to 8.7.14, or 8.8.x prior to 8.8.6. It is, therefore, affected by multiple vulnerabilities. - In jQuery versions greater than or equal to 1.2 an...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002

The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are ... security issues in jQuery’s DOM manipulation methods, as in .html, .append, and the others. Security advisories for...

DuckDuckGo: DOM XSS on duckduckgo.com search

Hello, The is a DOM XSS vulnerability on https://duckduckgo.com search through the relsexp parameter. PoC URL: https://duckduckgo.com/?q=a&relsexp="&ia=web Screenshot: F830875 Video: F830880 Impact The attacker can execute JS code...

CVE-2020-7809

ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...

Cross site scripting

ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...