796 matches found
SUSE CVE-2022-38223
There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HTML file to the w3m binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact...
CVE-2023-21805
Windows MSHTML Platform Remote Code Execution Vulnerability...
The vulnerability of the DevTools set of tools for web development in the Google Chrome web browser allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the DevTools set of tools for web development in the Google Chrome web browser is related to type conversion errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created HTML page...
UBUNTU-CVE-2023-0699
Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page and browser shutdown. Chromium security severity: Medium...
Google Chrome 缓冲区错误漏洞
Google Chrome is a web browser from Google, Inc. in the United States. A security vulnerability exists in versions of Google Chrome prior to 109.0.5414.74, which stems from a possible heap buffer overflow in its Network Service Allows an attacker to convince a user to install a malicious extensio...
USN-5796-1 w3m vulnerability
It was discovered that w3m incorrectly handled certain HTML files. A remote attacker could use this issue to cause w3m to crash, resulting in a denial of service, or possibly execute arbitrary code...
PT-2022-9009 · Feehicms · Feehicms
Name of the Vulnerable Software and Affected Versions: FeehiCMS version 2.0.8 Description: The issue allows remote attackers to run arbitrary code via the lang attribute of an HTML tag. This is a Cross Site Scripting XSS issue, which enables attackers to execute scripts in the context of another...
Google Chrome 安全漏洞
Google Chrome is a web browser from Google, an American company. A type obfuscation vulnerability exists in versions of Google Chrome prior to V8 108.0.5359.71, which can be exploited by remote attackers to launch an attack via a crafted HTML page using heap corruption...
XSS in Desktop Client in the notifications
None...
PT-2022-24906 · Nextcloud +2 · Nextcloud Desktop Client +2
Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop client versions prior to 3.6.1 Description: An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. There are no known workarounds for this issue. Recommendations: For versions prior t...
CVE-2022-39332 Cross-site scripting (XSS) in Nextcloud Desktop Client
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for...
CVE-2022-39332
Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for...
CVE-2022-3652
Type confusion in V8 in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
UBUNTU-CVE-2022-3317
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 106.0.5249.62 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Low...
The vulnerability of the CERT/CC VINCE software coordination mechanism lies in its lack of measures to neutralize special elements, allowing attackers to inject arbitrary HTML code.
The vulnerability of the CERT/CC VINCE software coordination mechanism exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code remotely, using the “Product Affected” field...
Nextcloud: XSS in Desktop Client via user status and information
Summary: The Nextcloud Desktop Client application does not properly neutralize the Full Name and Status Message of users before using them. Steps To Reproduce: Server Machine: 1. Install the Nextcloud Server application 2. Log into your account 3. Navigate to your profile page 4. Set the Full Nam...
CVE-2022-2635
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
GLPI 跨站脚本漏洞
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...