CVE-2024-42515

CVE-2024-42515 affects Glossarizer (1.5.2 and earlier). The vulnerability arises when correctly escaping characters is bypassed because the underlying library converts encoded characters into real HTML, enabling stored XSS via appending a payload to a glossary entry. Affected component is Glossar...

Design/Logic Flaw

Wire web-app is part of Wire communications. Versions prior to 2022-11-02 are subject to Improper Handling of Exceptional Conditions. In the wire-webapp, certain combinations of Markdown formatting can trigger an unhandled error in the conversion to HTML representation. The error makes it...

PT-2022-10098 · Nbconvert +1 · Nconvert +1

Name of the Vulnerable Software and Affected Versions: nbconvert version 5.5.0 Description: The GitHub Security Lab discovered a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary...

SUSE SLES12: libpoppler-cpp0 / libpoppler-devel / libpoppler-glib-devel / etc (SUSE-SU-2022:1723-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1723-1 advisory. - CVE-2020-27778: Fixed a buffer overflow in pdftohtml bsc1179163. - CVE-2019-14494: Fixed a divide-by-zero error in pdftoppm...

ansi_up cross-site scripting vulnerability

The npm package ansiup converts ANSI escape codes into HTML. In ansiup v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting XSS vulnerability. This issue is fixed in v5.0.0...

UBUNTU-CVE-2021-3377

The npm package ansiup converts ANSI escape codes into HTML. In ansiup v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting XSS vulnerability. This issue is fixed in v5.0.0...

CVE-2020-27778

A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service...

[SECURITY] Fedora 31 Update: htmldoc-1.9.7-1.fc31

HTMLDOC converts HTML source files into indexed HTML, PostScript, or Portable Document Format PDF files that can be viewed online or printed. With no options a HTML document is produced on stdout. The second form of HTMLDOC reads HTML source from stdin, which allows you to use HTMLDOC as a filter...

[SECURITY] Fedora 30 Update: htmldoc-1.9.7-1.fc30

HTMLDOC converts HTML source files into indexed HTML, PostScript, or Portable Document Format PDF files that can be viewed online or printed. With no options a HTML document is produced on stdout. The second form of HTMLDOC reads HTML source from stdin, which allows you to use HTMLDOC as a filter...

[SECURITY] Fedora 28 Update: unrtf-0.21.9-8.fc28

UnRTF is a command-line program written in C which converts documents in Rich Text Format .rtf to HTML, LaTeX, troff macros, and RTF itself. Converting to HTML, it supports a number of features of Rich Text Format: Changes in the text's font, size, weight bold, and slant italic Underlines and...

Foxit PhantomPDF fxhtml2pdf HTML Conversion Out-Of-Bounds Access Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within fxhtml2pdf. The...

Stack overflow

In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 Windows/Linux, an exploitable stack-based buffer overflow exists in the DOC-to-HTML conversion functionality of the Hyland Perceptive Document Filters version 11.4.0.2647. A crafted .doc document can lead to a stack-based buffer, resulti...

AntennaHouse DMC HTMLFilter Doc_SetSummary Code Execution Vulnerability(CVE-2016-8382)

Summary An exploitable heap corruption vulnerability exists in the DocSetSummary functionality of AntennaHouse DMC HTMLFilter. A specially crafted doc file can cause a heap corruption resulting in arbitrary code execution. An attacker can send a malicious doc file to trigger this vulnerability...

[PDFMiner] Python PDF parser and analyzer

PDFMiner is a tool for extracting information from PDF documents. Unlike other PDF-related tools, it focuses entirely on getting and analyzing text data. PDFMiner allows one to obtain the exact location of text in a page, as well as other information such as fonts or lines. It includes a PDF...

[SECURITY] Fedora 17 Update: ikiwiki-3.20120516-1.fc17

Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...

[SECURITY] Fedora 15 Update: ikiwiki-3.20111106-2.fc15

Ikiwiki is a wiki compiler. It converts wiki pages into HTML pages suitable for publishing on a website. Ikiwiki stores pages and history in a revision control system such as Subversion or Git. There are many other features, including support for blogging, as well as a large array of plugins...

JForum 2.08 Cross Site Scripting

Minded Security Labs: Advisory MSA130510 JForum ?s?i\color='"?.?^'"'"?.?/color\ $2 As it's possible to see from the previous code, "color" attribute expects a parameter between single quotes. Jforum does not encode single quotes, so it's possible to a...

[SECURITY] Fedora 10 Update: htmldoc-1.8.27-8.fc10

HTMLDOC converts HTML source files into indexed HTML, PostScript, or Portable Document Format PDF files that can be viewed online or printed. With no options a HTML document is produced on stdout. The second form of HTMLDOC reads HTML source from stdin, which allows you to use HTMLDOC as a filter...

Microsoft Windows Search脚本注入漏洞(MS09-023)

BUGTRAQ ID: 35220 CVECAN ID: CVE-2009-0239 Windows Search允许即时搜索大多数公共文件和数据类型，例如电子邮件、联系人、日历约会、文档、照片、多媒体和由第三方扩展的其他格式。 Windows Search通过嵌入式的浏览器向用户预览搜索结果。为了支持非HTML/XML文件，Windows Search会将这类文件转换为HTML，但转换器在转义字符的时候没有执行任何过滤便将文件加载到了内嵌的浏览器中。根据嵌入式浏览器的安全设置，上述本地HTML文件无需用户同意便拥有部分JavaScript执行权限。...

RoarSmithinfo2www远程执行任意命令漏洞

BugCVE: CVE-1999-0266 BUGTRAQ: 1995 “info2www”是一个将GNU Info文本转化成HTML文件的CGI程序。 某些早期版本的info2www脚本实现上存在输入验证漏洞，远程攻击者可以利用此漏洞以Web进程的权限在主机上 执行任意系统命令。 问题在于程序脚本没有过滤用户输入中包含的一些shell元字符，远程攻击者可能以Web守护程序的权限（root或nobody）在主机上执行任意程序。 1.0-1.1 临时解决方法： 如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：...