The vulnerability of the Google Chrome browser’s WebUI user interface allows a hacker to circumvent existing access restrictions.

The vulnerability in the user interface of Google Chrome’s WebUI exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to circumvent existing access restrictions by using a specially created HTML page...

The vulnerability of the Google Chrome browser’s Media component, caused by a numerical overflow, allows a malicious actor to trigger an overflow in the buffer through a specially created HTML page.

The vulnerability of the Google Chrome browser’s Media component is caused by a numerical overflow condition. Exploiting this vulnerability allows an attacker to trigger the overflow by using a specially created HTML page...

CVE-2021-45017

Cross Site Request Forgery CSRF vulnerability exits in Catfish =6.1. when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability...

netty: possible request smuggling in HTTP/2 due missing validation

In Netty io.netty:netty-codec-http2 before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by Http2MultiplexHandler as it is propagated up. This is fine as long as the...

CVE-2021-39910

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitLab was vulnerable to HTML Injection through the Swagger UI feature...

The vulnerability of the ArcGIS Server server, related to improper handling of code generation, allows a attacker to execute arbitrary HTML code.

The vulnerability of ArcGIS Server is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code remotely...

GHSA-WX5J-54MM-RQQQ HTTP request smuggling in netty

Impact Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names...

ArcGIS Server 代码注入漏洞

Esri Arcgis Server is a web-oriented, enterprise-class software platform that can be used to provide geolocation services from Esri, Inc. in the United States. A security vulnerability exists in ArcGIS Server that allows an attacker to inject html content into a page...

CVE-2021-42564

An open redirect through HTML injection in confidential messages in Cryptshare before 5.1.0 allows remote attackers with permission to provide confidential messages via Cryptshare to redirect targeted victims to any URL via the 'meta http-equiv="refresh"' substring in the editor parameter...

Business-Dna Solution GmbH TopEase 跨站脚本漏洞

Business-Dna Solution GmbH TopEase is a "transformational risk" solution from the Swiss company Business-Dna Solution GmbH. A cross-site scripting vulnerability exists in Business-Dna Solution GmbH TopEase, which can be exploited by attackers to inject arbitrary HTML and JavaScript into object...

DEBIAN-CVE-2021-38001

Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability...

ASUS routers 安全漏洞

ASUS routers is a router app from ASUS of Taiwan, China. A security vulnerability exists in ASUS routers that stems from a problem with the router firmware's limit on the number of login attempts, which allows remote attackers to attempt an arbitrary number of login attempts by sending a specific...

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability...

The vulnerability of the Blink rendering module in Google Chrome and Microsoft Edge browsers allows a hacker to execute arbitrary code or cause a service failure.

The vulnerability of the Blink rendering module in Google Chrome and Microsoft Edge browsers is related to the execution of operations outside the buffer during the processing of HTML content. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service...

Puppet Server 安全漏洞

Puppet Server is a software from Puppet Labs in the U.S. for pushing configurations from the primary server to other servers. an information disclosure vulnerability exists in Puppet Agent and Puppet Server, which stems from a lack of restrictions and protections in the HTTP transport process,...

sqlite: dropping of shadow tables not restricted in defensive mode

Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page...