WordPress Press Elements – Widgets for Elementor plugin <= 1.7.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Press Elements – Widgets for Elementor plugin versions = 1.7.2. Solution No patched version available...

WordPress "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)" plugin < 1.5.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress "Unlimited Elements For Elementor Free Widgets, Addons, Templates" plugin versions 1.5.3. Solution Update the WordPress "Unlimited Elements For Elementor Free Widgets, Addons, Templates" plugin to the latest available version ...

WordPress "Unlimited Elements For Elementor (Free Widgets, Addons, Templates)" plugin < 1.5.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Unlimited Elements For Elementor Free Widgets, Addons, Templates" plugin versions 1.5.3. Solution Update the WordPress "Unlimited Elements For Elementor Free Widgets, Addons, Templates" plugin to the...

CVE-2022-23810

The CVE-2022-23810 issue affects a-blog cms (Appleple) with template injection (Improper Neutralization of Special Elements Used in a Template Engine). A remote authenticated attacker can obtain arbitrary files on the server via unspecified vectors. Affected versions include: 2.8.x before 2.8.75,...

Sanitization bypass in SVG Sanitizer

The SVG sanitizer library enshrined/svg-sanitize before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+xml were not affected...

The vulnerability in the implementation of the Autofill function in Google Chrome and Microsoft Edge browsers allows attackers to circumvent existing security restrictions.

The vulnerability of Autofill implementations in Google Chrome and Microsoft Edge browsers is related to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions remotely...

CVE-2021-46679

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements...

Openmct 跨站脚本漏洞

Nasa Openmct is an open source open mission control technology from NASA, Inc. It is used to visualize data on desktop and mobile devices. A cross-site scripting vulnerability exists in Openmct up to version 1.7.7, which stems from the software's lack of effective filtering and escaping of...

Nasa Open Mct 跨站脚本漏洞

Nasa Open Mct is an open source open mission control technology from NASA, Inc. for visualizing data on desktop and mobile devices. A cross-site scripting vulnerability exists in Nasa Open mct versions 1.3.0 through 1.7.7, which stems from a lack of valid filtering and escaping of Web Page...

CVE-2022-24979

An issue was discovered in the Varnishcache extension before 2.0.1 for TYPO3. The Edge Site Includes ESI content element renderer component does not include an access check. This allows an unauthenticated user to render various content elements, resulting in insecure direct object reference IDOR,...

CVE-2022-24979

The CVE-2022-24979 vulnerability affects the Varnishcache extension for TYPO3 (before 2.0.1). The Edge Site Includes (ESI) content element renderer does not perform an access check, enabling an unauthenticated user to render various content elements and potentially access internal content (IDOR)....

Curve.IsOnCurve in crypto/elliptic in Go before 1.16.14 and 1.17.x before 1.17.7 can incorrectly return true in situations with a big.Int value that is not a valid field element.

...

The vulnerability of the Service Worker API in browsers such as Google Chrome and Microsoft Edge allows a malicious actor to execute arbitrary code.

The vulnerability of the Service Worker API in browsers such as Google Chrome and Microsoft Edge is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the Scroll component in Google Chrome allows a hacker to gain access to confidential information or cause a service failure.

The vulnerability of the Scroll component in Google Chrome relates to improperly implemented security checks for standard elements. Exploiting this vulnerability can allow an attacker to access confidential information or cause service failures...

Mozilla: Sandboxed iframes could have executed script if the parent appended elements

The Mozilla Foundation Security Advisory describes this flaw as: If a document created a sandboxed iframe without allow-scripts and subsequently appended an element to the iframe's document that, for example, had a JavaScript event handler - the event handler would have run despite the iframe's...

Mozilla: Sandboxed iframes could have executed script if the parent appended elements

The Mozilla Foundation Security Advisory describes this flaw as: If a document created a sandboxed iframe without allow-scripts and subsequently appended an element to the iframe's document that, for example, had a JavaScript event handler - the event handler would have run despite the iframe's...

Mozilla: Sandboxed iframes could have executed script if the parent appended elements

The Mozilla Foundation Security Advisory describes this flaw as: If a document created a sandboxed iframe without allow-scripts and subsequently appended an element to the iframe's document that, for example, had a JavaScript event handler - the event handler would have run despite the iframe's...

containernetworking/cni improper limitation of path name

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the syste...

A cross-site scripting vulnerability

Description Impact SVG sanitizer library before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+xml were not affected. Patches This...

A cross-site scripting vulnerability

Impact SVG sanitizer library before version 0.15.0 did not remove HTML elements wrapped in a CDATA section. As a result, SVG content embedded in HTML fetched as text/html was susceptible to cross-site scripting. Plain SVG files fetched as image/svg+xml were not affected. Patches This issue is fix...