CVE-2022-25849

The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting XSS because the module of parse markdown does not filter the href attribute very well...

CVE-2022-25849 Cross-site Scripting (XSS)

The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting XSS because the module of parse markdown does not filter the href attribute very well...

PT-2022-17566 · Joyqi · Hyper-Down

Name of the Vulnerable Software and Affected Versions: joyqi/hyper-down versions 0.0.0 and later Description: The issue arises from improper validation of the href attribute in the markdown parser module, leading to Cross-site Scripting XSS. There is no information about the estimated number of...

CVE-2022-25849: Improper Neutralization of Input During Web Page Generation

The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting XSS because the module of parse markdown does not filter the href attribute very well...

Cross-site Scripting (XSS)

firefox is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the href attribute of SVG tags, allowing an attacker to inject and execute malicious javascript...

PT-2022-19248 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: SilverStripe Framework versions prior to 4.10.9 SilverStripe Framework through 2022-04-07 Description: The issue allows for Stored XSS to occur in javascript link tags added via XMLHttpRequest XHR. This can happen when an authenticated CMS us...

MediaWiki Cross-site Scripting (XSS) vulnerability

In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, XSS related to jQuery can occur. The attacker creates a message with javascript:payload xss and turns it into a jQuery object with mw.message.parse. The expected result is that the jQuery object does not contain an tag or it does...

CVE-2021-24817: Improper Neutralization of Input During Web Page Generation

The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks...

Cross site scripting

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues...

The vulnerability of the library for working with SVG images in Apache Batik, related to incorrect processing of data in the “xlink:href” attribute, allows attackers to perform CSRF attacks.

The vulnerability of the Apache Batik library for working with SVG images is related to improper processing of data in the “xlink:href” attribute. Exploiting this vulnerability can allow a remote attacker to perform CSRF attacks using specially crafted GET requests...

batik: SSRF via "xlink:href"

A flaw was found in the Apache Batik library, where it is vulnerable to a Server-Side Request Forgery attack SSRF via "xlink:href" attributes. This flaw allows an attacker to cause the underlying server to make arbitrary GET requests. The highest threat from this vulnerability is to system...

Security Bulletin: Dynamically constructed href attribute in IBM Enterprise Records

Summary The place where this happens is believed to be dead code, but we do not want to just start deleting things in the code without sufficient time to test. Vulnerability Details Third Party Entry: PSIRT-ADV0025106 DESCRIPTION: Created from Advisory: ADV0025106 CVSS Base score: 5.4 CVSS Vector...

GHSA-M7QM-R2R5-F77Q Cross-Site Scripting in react-marked-markdown

All versions of react-marked-markdown are vulnerable to cross-site scripting XSS via href attributes. This is exploitable if user is provided to react-marked-markdown Proof of concept: import React from 'react' import ReactDOM from 'react-dom' import MarkdownPreview from 'react-marked-markdown'...

GHSA-6QQJ-RX4W-R3CJ CSRF Vulnerability in jquery-ujs

Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains. When an attacker controls the href attribute of an anchor tag, or the action attribute of a fo...

CVE-2020-2223

A flaw was found in Jenkins versions 2.244 and prior and in LTS 2.235.1 and prior. HREF attribute of links to downstream jobs are not escaped on build console pages which could lead to a stored cross-site scripting XSS vulnerability. The user must have the Agent/Configure permission for this...

CVE-2020-2223: Improper Neutralization of Input During Web Page Generation

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape correctly the 'href' attribute of links to downstream jobs displayed in the build console page, resulting in a stored cross-site scripting vulnerability...

CVE-2020-11737: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring including the quotes followed...

CVE-2019-1010113: Improper Neutralization of Input During Web Page Generation

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting XSS. The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a lin...

CVE-2019-12173

MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...

Remote code execution

MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...