Cross-Site Scripting via Rich-Text Content

Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC 5.7 Problem Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via...

GHSA-WMWP-PGGC-H4MJ Cross-site Scripting in Documize

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS...

Cross-site Scripting in Documize

domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS...

Cross-site Scripting (XSS)

aurelia-templating-resources is vulnerable to cross-site scripting. The vulnerability exists because of the use of insecure default HTML sanitizer which only attempts to filter SCRIPT elements...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-28957

An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safeattrsonly and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run...

CVE-2021-23974

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

CVE-2021-23974

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

CVE-2021-23974

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

Hardcoded credentials

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

UBUNTU-CVE-2021-23974

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

CVE-2021-23974

CVE-2021-23974 affects Mozilla Firefox earlier than version 86. The root cause is improper handling of elements by the DOMParser API, enabling a mXSS vector that could bypass HTML sanitizers. Affected/related advisories (e.g., MFSA2021-07) confirm the DOMParser issue among Firefox vulnerabilitie...

CVE-2021-23974

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

CVE-2021-23974

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

CVE-2021-23974

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

CVE-2021-23974: Undefined Security Weakness

The DOMParser API did not properly process ' ' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox 86...

Cross-site Scripting(XSS)

firefox is vulnerable to cross-site scripting The DOMParser API did not properly process elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer...

PT-2021-15631

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 86 Description: The DOMParser API did not properly process '' elements for escaping, which could be used as an mXSS vector to bypass an HTML Sanitizer. Recommendations: For Firefox versions prior to 86, update to...

USN-4543-1: Sanitize vulnerability

Michał Bentkowski discovered that Sanitize did not properly sanitize some math or svg HTML under certain circumstances. A remote attacker could potentially exploit this to conduct cross-site scripting XSS attacks. CVE-2020-4054...

Cross-Site Scripting (XSS)

github.com/documize/community is vulnerable to cross-site scripting XSS. The application does not properly convert markdown data into HTML. An attacker will potentially be able to inject and execute arbitrary Javascript in a victim's browser. The bluemonday HTML sanitizer is used to address this...