5631 matches found
Fullscreen application interface Google Chrome Data Compromise
The vulnerability of the Fullscreen application interface of Google Chrome browser is related to improper security checks for standard elements. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...
Node.js security vulnerabilities
Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in nodejs that stems from not strictly using CRLF sequences to delimit HTTP requests, which could lead to HTTP request smuggling HRS...
StruxureWare Data Center Expert XSS
The vulnerability of the StruxureWare Data Center Exper monitoring system relates to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack at the final download point of a DCE file, by modifying paramete...
golang: html/template: backticks not treated as string delimiters
A flaw was found in Golang Go. This flaw allows a remote attacker to execute arbitrary code on the system, caused by not properly considering backticks as Javascript string delimiters. By sending a specially crafted request, an attacker execute arbitrary code on the system...
Zoom Client injection vulnerability
Zoom Client is a video conferencing client application from Zoom Inc. that supports multiple platforms. A security vulnerability exists in Zoom Client versions prior to 5.13.10 that stems from the inclusion of an HTML injection, which can be exploited by an attacker to inject HTML into the displa...
Zoom Client injection vulnerability
Zoom Client is a video conferencing client application from Zoom USA that supports multiple platforms. A security vulnerability exists in Zoom Client versions prior to 5.13.10, which stems from the inclusion of an HTML injection that could cause the Zoom application to crash if a victim begins...
WordPress Plugin WP HTML Mail Cross-Site Script Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
UBUNTU-CVE-2023-33476
ReadyMedia MiniDLNA versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the...
DEBIAN-CVE-2023-2940
Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. Chromium security severity: Medium...
PT-2023-23964 · Unknown · Parse Javascript Sdk +1
Name of the Vulnerable Software and Affected Versions: Parse Server versions prior to 5.4.4 and 6.1.1 Description: The issue involves a phishing attack vulnerability where a malicious user can upload an HTML file to Parse Server via its public API. This uploaded HTML file can then be accessed at...
JStachio Cross-Site Script Vulnerability
JStachio is a type-safe Java Mustache template engine. A security vulnerability exists in JStachio versions prior to 1.0.1, which stems from JStachio's inability to escape single quotes in HTML, and can be exploited by an attacker to inject malicious code...
OESA-2023-1294 golang security update
The Go Programming Language. Security Fixes: Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into...
CVE-2023-31594
IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network...
PT-2023-23399
Name of the Vulnerable Software and Affected Versions IC Realtime ICIP-P2012T version 2.420 Description The issue concerns an Incorrect Access Control vulnerability. It can be exploited via an exposed HTTP channel using the VLC network. Recommendations For IC Realtime ICIP-P2012T version 2.420,...
Cisco Identity Services Engine File Deletion
The vulnerability in the web interface for managing Cisco Identity Services Engine ISE platforms relates to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to delete arbitrary files using a specially created HTTP request...
USN-6100-1 libhtml-stripscripts-perl vulnerability
It was discovered that HTML::StripScripts does not properly parse HTML content with certain style attributes. A remote attacker could use this issue to cause a regular expression denial of service ReDoS...
golang: net/http: handle server errors after sending GOAWAY
A flaw was found in the golang package. In net/http in Go, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if a fatal error preempts the shutdown...
DEBIAN-CVE-2023-2725
Use after free in Guest View in Google Chrome prior to 113.0.5672.126 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
AZL-37470 CVE-2023-29400 affecting package golang for versions less than 1.21.6-1
Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...
Python Packaging Authority Installation Tools Regex DoS
The vulnerability of Python Packaging Authority’s installation tools is related to insufficient input validation when processing HTML content. Exploiting this vulnerability allows a remote attacker to deliver specially crafted data to the application and perform a “denial-of-service” attack using...