497 matches found
CVE-2024-56359: Improper Neutralization of Input During Web Page Generation
grist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier meaning for example Ctrl+click could have their account compromised, since the link could use the javascript: scheme and be evaluated in the context...
Adobe InDesign 14.0.0 < 14.0.2 Arbitrary Code Execution (APSB19-23) (macOS)
The version of Adobe InDesign installed on the remote macOS host is prior to 14.0.2. It is, therefore, affected by a vulnerability as referenced in the APSB19-23 advisory. - Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing vulnerability. Successful exploitation could...
CVE-2024-49279
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-block allows Stored XSS.This issue affects Hyperlink Group Block: from n/a through = 1.17.5...
CVE-2024-49279
CVE-2024-49279 concerns WordPress Hyperlink Group Block plugin, affected versions
CVE-2024-49279 WordPress Hyperlink Group Block plugin <= 1.17.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-block allows Stored XSS.This issue affects Hyperlink Group Block: from n/a through = 1.17.5...
CVE-2024-49279 WordPress Hyperlink Group Block plugin <= 1.17.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in TipTopPress Hyperlink Group Block allows Stored XSS.This issue affects Hyperlink Group Block: from n/a through 1.17.5...
WordPress plugin Hyperlink Group Block 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...
PT-2024-33418 · Tiptoppress · Tiptoppress Hyperlink Group Block
Name of the Vulnerable Software and Affected Versions: TipTopPress Hyperlink Group Block versions 1.17.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...
CVE-2024-49279: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-block allows Stored XSS.This issue affects Hyperlink Group Block: from n/a through = 1.17.5...
WordPress Hyperlink Group Block plugin <= 1.17.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Khalid Yusuf Patchstack Alliance in WordPress Plugin Hyperlink Group Block versions = 1.17.5...
WordPress Hyperlink Group Block Plugin <= 1.17.5 is vulnerable to Cross Site Scripting (XSS)
Software Hyperlink Group Block Type Plugin Vulnerable versions = 1.17.5 Fixed in 1.17.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-49279 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c125a0adb315 Credits Khalid Yusuf Required privileg...
CVE-2024-41997
An issue was discovered in version of Warp Terminal prior to 2024.07.18 v0.2024.07.16.08.02. A command injection vulnerability exists in the Docker integration functionality. An attacker can create a specially crafted hyperlink using the warp://action/docker/opensubshell intent that when clicked ...
CVE-2024-7840
In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a command injection attack is possible through improper neutralization of hyperlink elements...
CVE-2024-7840
In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a command injection attack is possible through improper neutralization of hyperlink elements...
PT-2024-38619 · Progress · Telerik Reporting
Name of the Vulnerable Software and Affected Versions: In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924 Description: A command injection attack is possible through improper neutralization of hyperlink elements. This issue arises due to the improper handling of hyperlink element...
CVE-2024-7840: Improper Neutralization of Special Elements used in a Command
In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a command injection attack is possible through improper neutralization of hyperlink elements...
CVE-2024-45292
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. \PhpOffice\PhpSpreadsheet\Writer\Html does not sanitize "javascript:" URLs from hyperlink href attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2,...
PT-2024-31545
Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 1.29.2 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0 Description The PhpOfficePhpSpreadsheetWriterHtml component in PHPSpreadsheet does not sanitize "javascript:" URLs from...
Telerik UI for WPF < 2024.3.924 Multiple Vulnerabilities
The version of Progress Telerik UI for WPF installed on the remote Windows host is prior to 2024 Q3 2024.3.924. It is, therefore, affected by multiple vulnerabilities: - A command injection attack is possible through improper neutralization of hyperlink elements. CVE-2024-7575 - A code execution...