USN-5198-1 htmldoc vulnerability

It was discovered that HTMLDOC improperly handled malformed URIs from an input html file. An attacker could use this to cause a denial of service...

CVE-2021-45017

Cross Site Request Forgery CSRF vulnerability exits in Catfish =6.1. when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability exits in Catfish =6.1. when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column...

CVE-2021-45017

Cross Site Request Forgery CSRF vulnerability exits in Catfish =6.1. when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column...

CVE-2021-45017

Catfish CMS CSRF in

WS-2021-0487

The “vc-platformVirtoCommerce” application versions v2.1 to v3.79.0 is affected by a stored XSS vulnerability via HTML file upload in the Asset Upload feature. This allows low privileged application users to store malicious scripts in the uploaded file. These scripts are executed in a victim’s...

PT-2021-24190

Name of the Vulnerable Software and Affected Versions: Catfish versions prior to 6.1. Description: A Cross Site Request Forgery CSRF issue exists when uploading an HTML file containing CSRF on a website that uses a Google editor. This allows specifying a malicious URL address in the Add Menu...

DEBIAN-CVE-2021-38504

When interacting with an HTML input element's file picker dialog with webkitdirectory set, a use-after-free could have resulted, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

CVE-2021-25975

In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file...

CVE-2021-25975: Improper Neutralization of Input During Web Page Generation

In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file...

CVE-2021-41372: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS and Cross-Site Request Forgery CSRF vulnerability exists when Power BI Report Server Template file pbix containing HTML files is uploaded to the server and HTML files are accessed directly by the victim. Combining these 2 vulnerabilities together, an attacker is able to...

Mozilla Firefox Security Advisory (MFSA2016-80) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

CVE-2021-41792

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to...

CVE-2021-41792

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to...

CVE-2021-41792: Server-Side Request Forgery (SSRF)

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to...

PT-2021-23406

Name of the Vulnerable Software and Affected Versions org.alfresco:alfresco-content-services versions through 6.2.2.18 org.alfresco:alfresco-transform-services versions through 1.3 Description An issue allows an attacker to trigger an unexpected request by the transformation engine using a crafte...

Hardcoded credentials

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly...

CVE-2021-24563

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly...

CVE-2021-24563 Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting

The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly...

CVE-2021-24563

The CVE-2021-24563 affects the WordPress Frontend Uploader plugin prior to v1.3.2. The vulnerability is a Stored Cross-Site Scripting (XSS) flaw caused by the plugin not preventing HTML file uploads via its form, enabling an unauthenticated user to upload an HTML file containing JavaScript that e...