CVE-2015-6790

CVE-2015-6790 affects Google Chrome up to version 47.0.2526.80, where WebPageSerializerImpl::openTagToString does not properly escape HTML entities, enabling injection of arbitrary script or HTML via crafted documents. Debian security advisory DSA-3418-1 confirms the fix in Chrome 47.0.2526.80-1~...

chromium-browser: Escaping issue in saved pages

The WebPageSerializerImpl::openTagToString function in WebKit/Source/web/WebPageSerializerImpl.cpp in the page serializer in Google Chrome before 47.0.2526.80 does not properly use HTML entities, which might allow remote attackers to inject arbitrary web script or HTML via a crafted document, as...

CVE-2015-6790

The WebPageSerializerImpl::openTagToString function in WebKit/Source/web/WebPageSerializerImpl.cpp in the page serializer in Google Chrome before 47.0.2526.80 does not properly use HTML entities, which might allow remote attackers to inject arbitrary web script or HTML via a crafted document, as...

change fontset 'icons' to html entities to improve security compliance

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Server. Using Confluence Cloud? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFCLOUD-38988. panel It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization...

change fontset 'icons' to html entities to improve security compliance

It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization especially banks that have strict security constraint fontset cannot be downloaded as a result this will not render on customer instance. I would recommend that we change the current...

change fontset 'icons' to html entities to improve security compliance

panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-38988. panel It seems that the icons in Confluence are currently rendered using fontset. This can be an issue for organization...

Vimeo: APIs for channels allow HTML entities that may cause XSS issue

Hello, I found Vimeo's bug bounty program on 1. Please find below details of a security issue I found. First, APIs for channels 2 allow you to put HTML and javascript to name or description of a channel. For example, an attacker can use a Python script like the following to put javascript to an...

Mail.ru: [connect.mail.ru] Memory Disclosure / IE XSS

Memory Disclosure ---- При обращении к сценариям https://connect.mail.ru/sharefriends https://connect.mail.ru/sharecount https://connect.mail.ru/sharebutton следующим образом: GET /xxx/%2e%2e/sharefriends HTTP/1.1 Host: connect.mail.ru выводится ошибка о некорректном пути invalid request path:...

TYPO3 Extension ke_dompdf 0.0.3 Remote Code Execution Vulnerability

The TYPO3 extension kedompdf contains a version of the dompdf library including all files originally supplied with it. This includes an examples page, which contains different examples for HTML-entities rendered as a PDF. This page also allows users to enter their own HTML code into a text box to...

Design/Logic Flaw

The Active Content Transformation functionality in Blue Coat ProxySG before SGOS 4.3.4.2, 5.x before SGOS 5.4.5.1, 5.5 before SGOS 5.5.4.1, and 6.x before SGOS 6.1.2.1 allows remote attackers to bypass JavaScript detection via HTML entities...

CVE-2010-5190

Technical details about CVE-2010-5190 are not publicly provided in the connected documents. The available sources reiterate the same description. Monitor for updated advisories to obtain concrete product/version, impact, or remediation information.

Scientific Linux Security Update : mysql on SL4.x i386/x86_64

CVE-2008-4098 mysql: incomplete upstream fix for CVE-2008-2079 CVE-2008-4456 mysql: mysql command line client XSS flaw CVE-2009-2446 MySQL: Format string vulnerability by manipulation with database instances crash CVE-2009-4030 mysql: Incomplete fix for CVE-2008-2079 / CVE-2008-4098 Multiple flaw...

CVE-2010-1619

Cross-site scripting XSS vulnerability in the fixnonstandardentities function in the KSES HTML text cleaning library weblib.php, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities...

CVE-2010-1619

Cross-site scripting XSS vulnerability in the fixnonstandardentities function in the KSES HTML text cleaning library weblib.php, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities...

CentOS Update for mysql CESA-2010:0110 centos4 i386

Check for the Version of mysql OpenVAS Vulnerability Test CentOS Update for mysql CESA-2010:0110 centos4 i386 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Moderate: Red Hat Security Advisory: mysql security update

Updated mysql packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server...

Mozilla Firefox 2.0.0.16 UTF-8 URL Remote Buffer Overflow Exploit

No description provided by source. !/usr/bin/python FireFox 2.0.0.16 Windows XP SP3 x86 Remote Exploit Author: Dominic Chell [email protected] Exploits the UTF-8 URL overflow vulnerability described in CVE-2008-0016. As of September 2009 there are no public exploits for this vulnerability...

Mozilla Firefox 2.0.0.16 - UTF-8 URL Remote Buffer Overflow

!/usr/bin/python FireFox 2.0.0.16 Windows XP SP3 x86 Remote Exploit Author: Dominic Chell Exploits the UTF-8 URL overflow vulnerability described in CVE-2008-0016. As of September 2009 there are no public exploits for this vulnerability. However, according to securityfocus an exploit is available...

Banner Student System Cross Site Scripting

| | ||| ||| | | | | | || || By: gamr | | | | | | ||| ||| Header Product - Banner Student System by SunGard Specific Page - http://www.EXAMPLE.com/PATH/twbkwbis.PSecurityQuestion Change Security Question Version - 7.4 / earlier versions could be effected also Product URL -...

php htmlentities/htmlspecialchars multibyte sequences

The 1 htmlentities and 2 htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465...