971 matches found
CVE-2024-23635
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...
Design/Logic Flaw
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...
CVE-2024-23635 AntiSamy malicious input can provoke XSS when preserving comments
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to 1.7.5, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...
OWASP AntiSamy Cross-Site Scripting Vulnerability
OWASP AntiSamy is a library for HTML and CSS coding from the US-based OWASP Foundation. A cross-site scripting vulnerability exists in OWASP AntiSamy versions prior to 1.7.5 that stems from an HTML parsing error...
Mutation Cross Site Scripting (mXSS)
OWASP AntiSamy is vulnerable to Mutation Cross Site Scripting mXSS. The vulnerability is due to improper parsing of HTML when the preserveComments directive is enabled in the policy. This issue can be exploited by an attacker by injecting malicious input to execute arbitrary JavaScript...
Cross site scripting
OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerabilit...
CVE-2023-51652
OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerabilit...
CVE-2023-51652 OWASP.AntiSamy mXSS when preserving comments
OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerabilit...
libxml2:html: Use-of-uninitialized-value in htmlCurrentChar
Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=4555539253952512 Project: libxml2 Fuzzing Engine: libFuzzer Fuzz Target: html Job Type: libfuzzermsanlibxml2 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...
PSA: Critical POP Chain Allowing Remote Code Execution Patched in WordPress 6.4.2
WordPress 6.4.2 was released today, on December 6, 2023. It includes a patch for a POP chain introduced in version 6.4 that, combined with a separate Object Injection vulnerability, could result in a Critical-Severity vulnerability allowing attackers to execute arbitrary PHP code on the site. We...
jsoup:HtmlFuzzer: Security exception in org.jsoup.parser.HtmlTreeBuilder.process
Project: https://github.com/jhy/jsoup.git Detailed Report: https://oss-fuzz.com/testcase?key=4910527285166080 Project: jsoup Fuzzing Engine: libFuzzer Fuzz Target: HtmlFuzzer Job Type: libfuzzerasanjsoup Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
Design/Logic Flaw
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the log...
CVE-2023-46235 FOG stored XSS on log screen via unsanitized request logging
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the log...
CVE-2023-46235 FOG stored XSS on log screen via unsanitized request logging
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the log...
Cross Site Scripting
AntiSamy is vulnerable to Cross Site Scripting. The vulnerability arises due to flawed parsing of the HTML being sanitized. As a result an attacker can execute malicious JavaScript on client side by using certain crafty inputs resulting in elements in comment tags being interpreted as executable...
CVE-2023-43643 mXSS in AntiSamy
AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a potential for a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the...
OWASP AntiSamy Cross-Site Scripting Vulnerability
OWASP AntiSamy is a library for HTML and CSS coding from the OWASP Foundation in the United States. A cross-site scripting vulnerability exists in OWASP AntiSamy versions prior to 1.7.4 that stems from an error in parsing cleaned HTML, where certain inputs may cause elements in comment tags to be...
libxml2:html: Heap-buffer-overflow in xmlDictLookupInternal
Project: https://gitlab.gnome.org/GNOME/libxml2.git Detailed Report: https://oss-fuzz.com/testcase?key=5231780321689600 Project: libxml2 Fuzzing Engine: afl Fuzz Target: html Job Type: aflasanlibxml2 Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address: 0x619000014498 Crash Stat...
Updated java packages fix security vulnerabilities
The updated packages fix security vulnerabilities and a file conflict : Improper connection handling during TLS handshake. CVE-2023-21930 Incorrect enqueue of references in garbage collector. CVE-2023-21954 Certificate validation issue in TLS session negotiation. CVE-2023-21967 Swing HTML parsing...
MGASA-2023-0272 Updated java packages fix security vulnerabilities
The updated packages fix security vulnerabilities and a file conflict : Improper connection handling during TLS handshake. CVE-2023-21930 Incorrect enqueue of references in garbage collector. CVE-2023-21954 Certificate validation issue in TLS session negotiation. CVE-2023-21967 Swing HTML parsing...