CVE-2021-34656 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the vwsnotice function found in the /inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7...

CVE-2021-34656 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat <= 5.2.7 Reflected Cross-Site Scripting

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the vwsnotice function found in the /inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7...

CVE-2021-34656

The CVE-2021-34656 entry documents a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “2Way VideoCalls and Random Chat – HTML5 Webcam Videochat”. The issue is triggered via the vws_notice function in the file ~/inc/requirements.php and affects versions up to and includin...

CVE-2021-34656: Improper Neutralization of Input During Web Page Generation

The 2Way VideoCalls and Random Chat - HTML5 Webcam Videochat WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the vwsnotice function found in the /inc/requirements.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.2.7...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. WordPress Plugins 2Way VideoCalls and Random Chat - HTML5 Webcam A cross-site scripting vulnerability exists...

tidy-html5:tidy_general_fuzzer: Heap-use-after-free in prvTidyInsertedToken

Project: https://github.com/htacg/tidy-html5.git Detailed Report: https://oss-fuzz.com/testcase?key=5709011289767936 Project: tidy-html5 Fuzzing Engine: afl Fuzz Target: tidygeneralfuzzer Job Type: aflasantidy-html5 Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address:...

WordPress 2Way VideoCalls and Random Chat – HTML5 Webcam Videochat plugin <= 5.2.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress 2Way VideoCalls and Random Chat – HTML5 Webcam Videochat plugin versions = 5.2.7. Solution Update WordPress 2Way VideoCalls and Random Chat – HTML5 Webcam Videochat plugin to the latest available version at least 5.2...

tidy-html5:tidy_xml_fuzzer: Stack-buffer-overflow in strcat

Detailed Report: https://oss-fuzz.com/testcase?key=5067820705644544 Project: tidy-html5 Fuzzing Engine: honggfuzz Fuzz Target: tidyxmlfuzzer Job Type: honggfuzzasantidy-html5 Platform Id: linux Crash Type: Stack-buffer-overflow WRITE Crash Address: 0x7ffff7f6cc20 Crash State: strcat prvTidystrrep...

tidy-html5:tidy_parse_string_fuzzer: Heap-buffer-overflow in prvTidygrowStack

Project: https://github.com/htacg/tidy-html5.git Detailed Report: https://oss-fuzz.com/testcase?key=5435805559554048 Project: tidy-html5 Fuzzing Engine: honggfuzz Fuzz Target: tidyparsestringfuzzer Job Type: honggfuzzasantidy-html5 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash...

tidy-html5:tidy_xml_fuzzer: Crash in ParseXMLElement

Detailed Report: https://oss-fuzz.com/testcase?key=4783309522599936 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidyxmlfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x6251000000ff Crash State: ParseXMLElement...

tidy-html5:tidy_fuzzer: Crash in GetSurrogatePair

Project: https://github.com/htacg/tidy-html5.git Detailed Report: https://oss-fuzz.com/testcase?key=5652203421564928 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidyfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x604000010000...

tidy-html5:tidy_fuzzer: Heap-buffer-overflow in prvTidyEncodeCharToUTF8Bytes

Detailed Report: https://oss-fuzz.com/testcase?key=5712187765555200 Project: tidy-html5 Fuzzing Engine: libFuzzer Fuzz Target: tidyfuzzer Job Type: libfuzzerasantidy-html5 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address: 0x625000002100 Crash State:...

CWA HTML5 | Unable to print using Citrix PDF Printer

When trying to print from a published application, the users select the "Citrix PDF Printer" observe the message: "Getting PDF file...." on the bottom right of the webpage but do not see the "Continue print dialog" after which the document would open within a new tab. Additionally, this behavior ...

The vulnerability of the HTMLSerializer class implementation in the sanitizer framework allows attackers to perform cross-site scripting attacks by exploiting it.

The vulnerability of the HTMLSerializer class implementation in the sanitization of user-input data based on the AntiSamy policy file is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site...

Exploit for Unsafe Reflection in Vmware Vcenter_Server

CVE-2021-21985 Vulnerable Code !06testclassmethodhtt...

CVE-2021-21985

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

Remote code execution

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

CVE-2021-21986

Summary: CVE-2021-21986 affects the vSphere Client (HTML5) by exploiting a flaw in the vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins. A remote attacker who can reach port 443 on vCenter ...

CVE-2021-21985

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

CVE-2021-21985

CVE-2021-21985 affects VMware vCenter Server via the vSphere Client (HTML5) and the default-enabled Virtual SAN Health Check plug‑in. Root cause: improper input validation leads to remote code execution when an attacker with network access to port 443 sends crafted input, enabling commands with u...