CVE-2026-40472

The CVE-2026-40472 affects the Hackage Haskell server (hackage-server). It enables stored XSS by injecting user-controlled metadata from .cabal files that is rendered into HTML href attributes without proper sanitization. The underlying issue is unsanitized rendering of certain metadata fields (e...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox for iOS prior to version 131.2, which originates when opening an external link to an HTTP website under certain circumstances, and can be exploited by...

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems, PHOENIX CONTACT WP 6xxx, arises due to errors in processing hypertext links. This vulnerability allows a intruder to gain unauthorized access to protected information.

The vulnerability of microprogrammed software in web panels for controlling and monitoring processes in industrial systems, PHOENIX CONTACT WP 6xxx, is related to errors in processing hypertext links. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized...

The vulnerability of the Firefox browser for Android, related to errors in processing hypertext links, allows attackers to gain access to confidential data.

The vulnerability of the Firefox browser for Android is related to errors in processing hypertext links. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

IBM CICS TX 安全漏洞

IBM CICS TX Advanced is a comprehensive, single transaction runtime package from IBM USA. It can provide a cloud-native deployment model for standalone applications. An Access Control Error vulnerability exists in IBM CICS TX Advanced version 11.1, which stems from a failure to set a security...

CVE-2020-4763

IBM Sterling File Gateway 6.0.0.0 through 6.0.3.2 and 2.2.0.0 through 2.2.6.5 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The...

October 3, 2017, update for Office 2016 (KB4011036)

October 3, 2017, update for Office 2016 KB4011036 This article describes update 4011036 for Microsoft Office 2016 that was released on October 3, 2017. This update has a prerequisite. Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer .msi-based edition o...

PowerPoint ‘Weakness’ Opens Door to Malicious Mouse-Over Attack

A researcher is sounding the alarm over what he believes could be a novel attack vector which allows a hacker to manipulate a PowerPoint file to download and begin the installation of malware, simply by hovering over a hypertext link. The technique does require a victim to accept one pop-up...

CVE-2011-5235

SQL injection vulnerability in mnoGoSearch before 3.3.12 allows remote attackers to execute arbitrary SQL commands via the hostname in a hypertext link...

Sql injection

SQL injection vulnerability in mnoGoSearch before 3.3.12 allows remote attackers to execute arbitrary SQL commands via the hostname in a hypertext link...