DEBIAN-CVE-2022-4912

Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

The vulnerability of the DevTools set of tools for web development in the Google Chrome web browser allows a hacker to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the DevTools suite for web development in the Google Chrome web browser relates to the use of memory after it is released. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause a service failure through the u...

The vulnerability of the Mojo browser’s IPC library in Google Chrome allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the Mojo library in Google Chrome browsers relates to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure or execute arbitrary code using a specially created HTML page...

JStachio 跨站脚本漏洞

JStachio is a type-safe Java Mustache template engine. A security vulnerability exists in JStachio versions prior to 1.0.1, which stems from JStachio's inability to escape single quotes in HTML, and can be exploited by an attacker to inject malicious code...

USN-6100-1 libhtml-stripscripts-perl vulnerability

It was discovered that HTML::StripScripts does not properly parse HTML content with certain style attributes. A remote attacker could use this issue to cause a regular expression denial of service ReDoS...

AZL-37470 CVE-2023-29400 affecting package golang for versions less than 1.21.6-1

Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...

The vulnerability of Python Packaging Authority’s installation tools is related to an incorrect regular expression, allowing a violator to trigger a service failure.

The vulnerability of Python Packaging Authority’s installation tools is related to insufficient input validation when processing HTML content. Exploiting this vulnerability allows a remote attacker to deliver specially crafted data to the application and perform a “denial-of-service” attack using...

rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack

A flaw was found in rubygem-actionpack where CSP headers were sent with responses that Rails considered "HTML" responses. This flaw allows an attacker to leave API requests without CSP headers and perform a Cross-site scripting attack...

CVE-2023-28459

pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export a non-default feature. Users were able to upload crafted HTML documents that trigger the reading of arbitrary files...

XWiki Commons 跨站脚本漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A cross-site scripting vulnerability exists in XWiki Commons, which stems from the fact that the HTML macro does not properly neutralize html tags related to scripts...

The vulnerability of the Metrics component in the Google Chrome browser allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Metrics component in Google Chrome browser relates to the issue of operations going beyond the buffer in memory when processing HTML content. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the Mozilla Firefox browser, related to the execution of operations beyond the buffer in memory, allows an attacker to execute arbitrary code.

The vulnerability of the Mozilla Firefox browser is related to the execution of operations beyond the buffer boundaries in memory when processing HTML content. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Google Chrome and Microsoft Edge browsers’ Intents function allows attackers to compromise the integrity of protected information.

The vulnerability of Intents functions in Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information through a specially created HTML page...

SUSE CVE-2023-1228

Insufficient policy enforcement in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...

DEBIAN-CVE-2023-1236

Inappropriate implementation in Internals in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to spoof the origin of an iframe via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2023-1234

Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromium security severity: Low...

DEBIAN-CVE-2023-1217

Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

QuickEntity Editor 跨站脚本漏洞

QuickEntity Editor is a QuickEntity Editor by atampy25 Personal Developer. A cross-site scripting vulnerability exists in QuickEntity Editor that stems from an uncleaned HTML tag in an entity name...

The vulnerability of the Video components in Microsoft Edge and Google Chrome allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Microsoft Edge and Google Chrome browser’s Video component is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information b...

SUSE CVE-2007-0478

WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remote attackers to conduct cross-site scripting XSS attacks and bypass some XSS protection schemes by embedding certain HTML tags within an HTML comment...