333 matches found
GHSA-4943-9VGG-GR5R Cross-site Scripting in quill
A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. No patch exists and no further releases are planned. This CVE is disputed. Researchers have claimed that...
Design/Logic Flaw
DISPUTED A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is...
CVE-2021-3163
A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...
CVE-2021-3163: Improper Neutralization of Input During Web Page Generation
A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...
PT-2020-13255
Name of the Vulnerable Software and Affected Versions Ignite Realtime Spark version 2.8.3 Description A issue was discovered where a chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the us...
CVE-2020-12772: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...
CVE-2018-18405
jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...
CVE-2018-18405
jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...
CVE-2018-18405
Removed by vendor...
CVE-2018-18405: Improper Neutralization of Input During Web Page Generation
jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...
PT-2020-8631 · Jquery · Jquery
Name of the Vulnerable Software and Affected Versions: jQuery version 2.2.2 Description: The issue allows for cross-site scripting XSS attacks via a crafted onerror attribute of an IMG element. Recommendations: For jQuery version 2.2.2, consider disabling the use of the onerror attribute in IMG...
Cerberus FTP Server Cross-Site Scripting Vulnerability (CNVD-2020-07242)
Cerberus FTP Server is a multi-channel Windows FTP server, in addition to containing regular FTP features, it also provides users with file access and management privileges, connection limitations, time, IP access, multi-path priority settings and more. A cross-site scripting vulnerability exists...
Cross site scripting
Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folderup.png IMG element not properly sanitizing user-inserted directory...
CVE-2020-5195: Improper Neutralization of Input During Web Page Generation
Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folderup.png IMG element not properly sanitizing user-inserted directory...
PT-2020-18296
Name of the Vulnerable Software and Affected Versions Cerberus FTP Server versions prior to 11.0.1 Cerberus FTP Server versions prior to 10.0.17 Description The issue allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL, exploiting a Reflected XSS...
CVE-2019-17625
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...
CVE-2009-2937
Cross-site scripting XSS vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed...
CVE-2015-9312
The newstatpress plugin before 1.0.5 for WordPress has XSS related to an IMG element...