PYSEC-2017-80

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline such as in java\nscript: or a crafted email address, related to the escape and autolink functions...

Design/Logic Flaw

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline such as in java\nscript: or a crafted email address, related to the escape and autolink functions...

CVE-2017-15612

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline such as in java\nscript: or a crafted email address, related to the escape and autolink functions...

CVE-2017-15612

The CVE relates to Mistune Python package: mistune.py in Mistune 0.7.4 contains an XSS vulnerability triggered by an unexpected newline (e.g., java\nscript:) or crafted email addresses, tied to escape and autolink handling. Connected sources document this vulnerability and show mitigations: openS...

CVE-2017-15612

mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline such as in java\nscript: or a crafted email address, related to the escape and autolink functions...

NVIDIA Windows GPU Display Driver Buffer Overflow Vulnerability

NVIDIA Windows GPU Display Driver is a set of graphics processor GPU graphics card drivers for Windows from NVIDIA. A security vulnerability in DxgkDdiEscape in nvlddmkm.sys of the NVIDIA Windows GPU Display Driver can be exploited by an attacker to cause a denial of service or gain elevated...

Shopify: [livechat.shopify.com] Cookie bomb at customer chats

When we visit the https://livechat.shopify.com/customer/chats/new page the ref and ssid URL parameters are used to set cookie values the way as follows: var getURLParameter = functionname return decodeURIComponentnew RegExp'?|&' + name + '=' + '^&;+?&||;|$'.execlocation.search||,""1.replace/+/g,...

Mozilla Firefox JIT escape Function Memory Corruption - Ver2 (CVE-2009-2477)

Mozilla Firefox is a web browser developed by Mozilla Foundation. The browser is capable of interpreting and rendering many types of content published on the Internet, including various versions of HTML, XML, XUL, JavaScript, and various graphic formats, and so on. The browser runs on Windows,...

Mozilla Firefox JIT escape Function Memory Corruption - Ver2 (CVE-2009-2477)

Mozilla Firefox is a web browser developed by Mozilla Foundation. The browser is capable of interpreting and rendering many types of content published on the Internet, including various versions of HTML, XML, XUL, JavaScript, and various graphic formats, and so on. The browser runs on Windows,...

phpdisk V7 sql盲注一枚

简要描述： 又到周末。 详细说明： 刚从官网上面下载下来的。 plugins\phpdiskclient\clientsub.php 我看了下这目录下的其他几个文件 在iconv后都调用了escape函数来转义 但是这个没有。 造就了注入。 $agent = $SERVER'HTTPUSERAGENT'; if$agent!='phpdisk-client' exit'PHPDisk Access Deny Invalid Entry!'; $uinfo = trimgpc'uinfo','P',''; parsestrpdencodebase64decode$uinfo,'DECODE...

PYSEC-2010-1

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting XSS protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element...

VulnCheck KEV: CVE-2009-2477

js/src/jstracer.cpp in the Just-in-time JIT JavaScript compiler aka TraceMonkey in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by...

Update Protection against Mozilla Firefox JIT escape Function Memory Corruption

A memory corruption vulnerability exists in Mozilla Firefox, a web browser developed by Mozilla Foundation. This flaw is due to the way Mozilla Firefox handles JIT Just-in-Time escape Function calls. A remote attacker can exploit this vulnerability by enticing a target user to open a malicious we...

Debian DSA-1910-1 : mysql-ocaml - missing escape function

It was discovered that mysql-ocaml, OCaml bindings for MySql, was missing a function to call mysqlrealescapestring. This is needed, because mysqlrealescapestring honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The adde...

Debian DSA-1909-1 : postgresql-ocaml - missing escape function

It was discovered that postgresql-ocaml, OCaml bindings to PostgreSQL's libpq, was missing a function to call PQescapeStringConn. This is needed, because PQescapeStringConn honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are use...

Fedora Core 10 FEDORA-2009-10582 (ocaml-mysql)

The remote host is missing an update to ocaml-mysql announced via advisory FEDORA-2009-10582. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Fedora Core 11 FEDORA-2009-10701 (ocaml-mysql)

The remote host is missing an update to ocaml-mysql announced via advisory FEDORA-2009-10701. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C ...

Fedora Core 10 FEDORA-2009-10595 (ocaml-postgresql)

The remote host is missing an update to ocaml-postgresql announced via advisory FEDORA-2009-10595. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyrig...

Fedora Core 10 FEDORA-2009-10582 (ocaml-mysql)

The remote host is missing an update to ocaml-mysql announced via advisory FEDORA-2009-10582. OpenVAS Vulnerability Test $Id: fcore200910582.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-10582 ocaml-mysql Authors: Thomas Reinke Copyright: Copyrigh...

Fedora 10 : ocaml-postgresql-1.12.3-1.fc10.2 (2009-10595)

New upstream version 1.12.3. - This contains a SECURITY fix for: https://bugzilla.redhat.com/showbug.cgi?id=529325 CVE-2009-2943 ocaml- postgresql: Missing escape function DSA-1909-1 HOWEVER you are not protected until you change your code to use the new connectionescapestring method. Note that...