20 matches found
CVE-2026-116206
YesWiki versions 4.2.0 before 4.7.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the use of the Twig raw filter to render comments submitted via the /api/comments endpoint, which allows authenticated users to inject scripts using wakka raw-HTML syntax . This can r...
GHSA-G9WG-98C2-QV3V TCPDF Cross-site Scripting vulnerability
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
TCPDF Cross-site Scripting vulnerability
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
CVE-2024-32489
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
DEBIAN-CVE-2024-32489
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
CVE-2024-32489
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
CVE-2024-32489
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
CVE-2024-32489: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
CVE-2024-32489
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
TCPDF security vulnerability
TCPDF is an open source library from Tecnick. It is used to generate PDF documents and barcodes. A security vulnerability exists in TCPDF versions prior to 6.7.4, which stems from incorrectly handling calls that use HTML syntax...
CVE-2024-32489
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
CVE-2024-32489
The TCPDF PHP library, a tool for generating PDF files on-the-fly, contains a vulnerability where it mishandles calls using HTML syntax . Specifically, the library fails to properly cleanse or remove script-related HTML tags , which can allow a malicious actor to perform cross-site scripting (XSS...
CVE-2024-32489
TCPDF before 6.7.4 mishandles calls that use HTML syntax...
CVE-2023-34464 XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10.5, and 15.1RC1 of org.xwiki.platform:xwiki-platform-web and any version prior to 14.4.8, 14.10.5, and 15.1.RC1 of...
Debian: Security Advisory (DLA-273-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
How to bypass libinjection in many WAF/NGWAF
Before we start, libinjection is a very popular open-source project created by Nick Galbreath from Signal Sciences. A lot of WAFs and NGWAFs use this library instead of regular expressions because of performance. For example, modsecurity since version 2.7.4 supports libinjection by two operators ...
Debian DLA-273-1 : tidy security update
Fernando Muoz discovered a security issue on the HTML syntax checker and reformatter tidy. Tidy did not properly process specific character sequences, and a remote attacker could exploit this flaw to cause a DoS, or probably, execute arbitrary code. Two different CVEs were assigned to this issue...
[SECURITY] [DSA 3309-1] tidy security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3309-1 [email protected] https://www.debian.org/security/ Alessandro Ghedini July 18, 2015 https://www.debian.org/security/faq -...