6255 matches found
CVE-2019-12136
There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element...
CVE-2019-12136
There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element...
CVE-2019-12136
There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element...
CVE-2019-12136
There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element...
CVE-2019-12136
BoostIO Boostnote 0.11.15 is affected by CVE-2019-12136. The vulnerability is an XSS in the UI when processing a label named mermaid, exploitable via a crafted SRC attribute of an IFRAME element. The issue originates from Boostnote’s rendering path for this label, enabling injection of malicious ...
PT-2019-12153
Name of the Vulnerable Software and Affected Versions Applaud HCM versions 4.0.42 and later Description The issue arises from the use of HTML tag fields for HTML inputs in a form, leading to a potential security risk. Specifically, it is related to an XSS vulnerability that can be triggered with ...
CVE-2019-12136: Improper Neutralization of Input During Web Page Generation
There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid, as demonstrated by a crafted SRC attribute of an IFRAME element...
PT-2019-12651
Name of the Vulnerable Software and Affected Versions BoostIO Boostnote version 0.11.15 Description The issue concerns a cross-site scripting XSS problem. It can be triggered via a label named mermaid by crafting the SRC attribute of an IFRAME element. Recommendations For BoostIO Boostnote versio...
Arbitrary Code Execution
Firefox, Firefox ESR and Thunderbird are vulnerable to arbitrary code execution attacks. A remote unauthenticated attacker could exploit the vulnerable URI Handler component by spoofing the origin of a modal alert via iframe content and the 'data:' protocol leading to potential code execution...
Information Disclosure
Firefox, Firefox ESR and Thunderbird are vulnerable to information disclosure. A remote unauthenticated attacker could exploit the vulnerable IFRAME Handler component to bypass same-origin policy protections on pages with embedded iframes during page reloads and access content on the top level pa...
Cross-site Scripting (XSS)
mozilla firefox is vulnerable to cross-site scripting XSS attacks. JavaScript event handler attributes on a tag will execute inside a sandboxed iframe that does not have the allow-scripts flag set...
Fedora 30 : glpi (2019-e50f92e4c1)
Version 9.4.1.1 Non exhaustive list of changes : - security Bad chevrons rendering on dropdowns 5468 - security Iframe and forms are rendered in rich text contents 5519 - security Type juggling authentication bypass 5520 - security Malicious images upload 5580 - security Password token date was n...
Vanilla: Hidden Stored XSS in nested post embeds
Summary: Comments can be crafted in a way that when quoted will trigger a hidden stored XSS payload. Requires initial user interaction. Description: When quoting a comment, an attacker can edit the insert embed-external data url field to contain a string which when parsed, can result in the...
Fedora 29 : glpi (2019-a66789a334)
Add security fix backported from 9.4 : - security Bad chevrons rendering on dropdowns 5468 - security Iframe and forms are rendered in rich text contents 5519 - security Type juggling authentication bypass 5520 - security Malicious images upload 5580 - security Password token date was not reset...
CVE-2018-4319
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...
DEBIAN-CVE-2018-4319
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...
Cross site scripting
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...
CVE-2018-4319
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...
CVE-2018-4319
CVE-2018-4319 describes a cross-origin issue in iframe handling resolved by improved tracking of security origins in WebKit-based components. Affected products include Safari/WebKit on iOS before iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, and iCloud for Windows 7.7. Apple security pag...