8405 matches found
CVE-2020-35895: Out-of-bounds Write
An issue was discovered in the stack crate before 0.3.1 for Rust. ArrayVec has an out-of-bounds write via element insertion...
CVE-2020-35903: Undefined Security Weakness
An issue was discovered in the dync crate before 0.5.0 for Rust. VecCopy allows misaligned element access because u8 is not always the type in question...
Zammad Cross-Site Scripting Vulnerability (CNVD-2020-75062)
Zammad is a Web-based open source helpdesk/customer support system. A stored cross-site scripting vulnerability exists in Zammad versions prior to 3.4.1. An attacker can exploit this vulnerability to execute malicious code via the Tags element in TIcket...
h1-ctf: Hacky Holidays Writeup
On December 12th, 2020, the CTF became live and the scope that we are allowed to attack was In Scope Domain - hackyholidays.h1ctf.com Our main motive was to infiltrate his network and take him down. The challenges appeared one by one till 24th of December. Here we will be going through all the...
CVE-2020-35730
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestringreplacer.php...
CVE-2020-35730
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestringreplacer.php...
Cross site scripting
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestringreplacer.php...
CVE-2020-26035
An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket...
CVE-2020-26035
An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket...
CVE-2020-26035: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket...
PT-2020-16272
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 3.4.1 Description An issue was discovered in Zammad, where there is Stored XSS via a Tags element in a Ticket. Recommendations For versions prior to 3.4.1, update to version 3.4.1 or later to resolve the issue...
CVE-2020-29203
struct2json before 2020-11-18 is affected by a Buffer Overflow because strcpy is used for S2JSTRUCTGETstringELEMENT...
MediaWiki cross-site scripting vulnerability (CNVD-2020-74054)
MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. MediaWiki before 1.35.1 suffers from a cross-site scripting vulnerability tha...
CVE-2020-29511
The encoding/xml package in Go all versions does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...
CVE-2020-29511
The encoding/xml package in Go all versions does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications...
CSS paint API: Being predictably random
Take a look at this: Space invaders If you're using a browser that supports the CSS paint API, the element will have a 'random' pixel-art gradient in the background. But it turns out, doing random in CSS isn't as easy as it seems… Initial implementation This isn't a full tutorial on the CSS paint...
MISP security vulnerabilities
MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. An ACL checking deficiency vulnerability exists in MISP versions prior to 2.4.135 related to...
MISP Cross-Site Scripting Vulnerability (CNVD-2020-66576)
MISP is an open source software solution for collecting, storing, distributing and sharing cybersecurity metrics and threats related to cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in the template element index view in MISP 2.4.134. The...
PT-2020-17050
Name of the Vulnerable Software and Affected Versions TP-Link WR and WDR series versions including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR882N, and WR708N Description The issue is a buffer overflow in the copy msg elemen...