407 matches found
CVE-2023-30452
The MoroSystems EasyMind - Mind Maps plugin before 2.15.0 for Confluence allows persistent XSS when saving a Mind Map with the hyperlink parameter...
SUSE CVE-2005-4636
OpenOffice.org 2.0 and earlier, when hyperlinks has been disabled, does not prevent the user from clicking the WWW-browser button in the Hyperlink dialog, which makes it easier for attackers to trick the user into bypassing intended security settings...
SUSE CVE-2007-5935
Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag...
SUSE CVE-2008-2379
Cross-site scripting XSS vulnerability in SquirrelMail before 1.4.17 allows remote attackers to inject arbitrary web script or HTML via a crafted hyperlink in an HTML part of an e-mail message...
The vulnerability of the text terminal utility for UNIX-like systems, Less, is related to incorrect filtering of built-in ANSI sequences during the processing of the -R element. This vulnerability allows an attacker to exploit their privileges.
The vulnerability of the text terminal utility for UNIX-like systems is related to incorrect filtering of built-in ANSI sequences during the processing of the -R element. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created hyperlink that...
XSS in hyperlink when create FAQ News
Description Stored Cross-Site Scripting XSS through hyperlinks refers to a type of security vulnerability that occurs when an attacker injects malicious code into a hyperlink, which is then stored in the application's database or web server. When a user clicks on the infected hyperlink, the...
USN-5848-1 less vulnerability
David Leadbeater discovered that less was not properly handling escape sequences when displaying raw control characters. A maliciously formed OSC 8 hyperlink could possibly be used by an attacker to cause a denial of service...
CXF: SSRF Vulnerability
A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type...
Stored XSS in Your Answer
Description Evil users can attack other users or administrator users through this vulnerability, causing other users/administrator user accounts to be taken over Proof of Concept step1. Insert xss payload in the hyperlink of the question answer javaScript:alertlocalStorage.getItem'alui' step2. An...
Open Redirect
rdiffweb is vulnerable to open redirect. The vulnerability exists because hyperlinks are not properly validated in the library which allows an attacker to inject a malicious link and send a phishing email invitation to users...
Rdiffweb 输入验证错误漏洞
Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. An input validation error vulnerability exists in Rdiffweb versions prior to 2.5.5, which originates from a hyperlink injection via a...
Rdiffweb 安全漏洞
Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A security vulnerability exists in Rdiffweb versions prior to 2.5.5, which stems from a lack of character cleanup in SSH key names...
Lack of sanitisation of characters in SSH key name could allow attacker to inject a hyperlink injection
Description Lack of sanitisation of characters in SSH key name could allow attacker to inject a hyperlink injection that could allow attacker to redirect victim to malicious websites Proof of Concept 1 Go to https://rdiffweb-dev.ikus-soft.com/prefs/sshkeys 2 Add SSH key 3 Enter the name evil.com ...
Hyperlink injection through access token name
Description Hyperlink Injection it’s when attacker injecting a malicious link when sending an email invitation. Hyperlink injection in the email can lead to phishing via email directly to users. Proof of Concept 1 Go to https://rdiffweb-dev.ikus-soft.com/prefs/tokens 2 Create a new access token...
Patrik Dufresne Rdiffweb user redirection vulnerability
Patrik Dufresne Rdiffweb is a web application from the personal developer Patrik Dufresne, USA. Patrik Dufresne Rdiffweb is vulnerable to a user redirection vulnerability, which stems from the fact that the system does not handle target bounces properly and can be exploited to inject malicious...
Rdiffweb 输入验证错误漏洞
Patrik Dufresne Rdiffweb is a web application from the personal developer Patrik Dufresne, USA. Patrik Dufresne Rdiffweb is vulnerable to a user redirection vulnerability, which stems from the fact that the system does not handle target bounces properly and can be exploited to inject malicious...
Hyperlink injection leads to redirect victim to malicious website
Description Hyperlink Injection it’s when attacker injecting a malicious link when sending an email invitation Proof of Concept 1 Go to https://rdiffweb-dev.ikus-soft.com/prefs/general 2 Set your full name as "Your account has been hacked please visit evil.com" 3 Save changes 4 Perform any activi...
CVE-2022-2600
The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object...
CVE-2022-2600
The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object...
CVE-2022-2600
The CVE-2022-2600 entry concerns the WordPress plugin Auto-hyperlink URLs (versions through 5.4.1). The underlying issue is that generated links do not include rel="noopener noreferer", enabling Tab Nabbing and potentially exposing the source tab via window.opener. The vulnerability impact, as do...