1123 matches found
CVE-2022-41348
An issue was discovered in Zimbra Collaboration ZCS 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure...
Information disclosure
An issue was discovered in Zimbra Collaboration ZCS 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure...
CVE-2022-41348
An issue was discovered in Zimbra Collaboration ZCS 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure...
CVE-2022-41348
CVE-2022-41348 affects Zimbra Collaboration (ZCS) 9.0. An XSS vulnerability exists via the onerror attribute of an IMG element, potentially leading to information disclosure. Multiple connected sources corroborate this description. The vulnerability is tied to ZCS 9.0 and is described as an XSS i...
CVE-2022-41348
An issue was discovered in Zimbra Collaboration ZCS 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure...
CVE-2022-37125
CVE-2022-37125 affects D-Link DIR-816 A2, specifically the /goform/NTPSyncWithHost endpoint. The connected documents consistently indicate a command injection vulnerability in the DIR-816 A2_v1.10CNB04.img, enabling arbitrary command execution via that API. The CVE entry lists a high/critical imp...
@fb24m/etc (>=1.0.0, <=1.2.0), pdf-exports (1.0.0) +1 more potentially affected by CVE-2022-21165 via font-converter (1.1.1)
font-converter NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on font-converter and may be impacted: - @fb24m/etc =1.0.0, =1.2.0 - pdf-exports 1.0.0 - pdf-img-exports 1.0.0 Source cves: CVE-2022-21165 Source advisory:...
PT-2022-23554 · Unknown · Ingredients Stock Management System
Name of the Vulnerable Software and Affected Versions: Ingredients Stock Management System version 1.0 Description: The issue allows for arbitrary file deletion via the /classes/Master.php component, specifically through the f parameter set to delete img. Recommendations: For Ingredients Stock...
D-Link DIR-816 Buffer Overflow Vulnerability
The D-Link DIR-816 is a wireless router from AUO D-Link of Taiwan, China. A buffer overflow vulnerability exists in the mirrored version of the D-link DIR-816 firmware A2v1.10CNB04.img. The vulnerability stems from the fact that when the wantype of its /goform/form2Wan.cgi component is 3, the...
CVE-2022-37133
D-link DIR-816 A2v1.10CNB04.img reboots the router without authentication via /goform/doReboot. No authentication is required, and reboot is executed when the function returns at the end...
CVE-2022-37133
The CVE-2022-37133 entry concerns D-Link DIR-816 DIR-816 A2 firmware A2_v1.10CNB04.img. The issue allows rebooting the router without authentication via the /goform/doReboot endpoint; a reboot is executed when the function returns, with no authentication required. This yields an impact to availab...
@fb24m/etc (>=1.0.0, <=1.2.0), pdf-exports (1.0.0) +1 more potentially affected by CVE-2022-21165 via font-converter (1.1.1)
font-converter NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on font-converter and may be impacted: - @fb24m/etc =1.0.0, =1.2.0 - pdf-exports 1.0.0 - pdf-img-exports 1.0.0 Source cves: CVE-2022-21165 Source advisory:...
Avoiding <img> layout shifts: aspect-ratio vs width & height attributes
By default, an takes up zero space until the browser loads enough of the image to know its dimensions: &origin=source&to=/c/senna-d1c8a036.jpg When you run the demo, you'll see the immediately. Then, after a few seconds, this paragraph and subsequent page content shifts downwards to make room for...
MAL-2022-3480 Malicious code in grunt-retina-img (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9aa5184d4dcea5cd3db2234a39ac0a884f63bfa99ba1c8919047d8c5349da3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-4WC5-GFGH-4VJX EpicEditor XSS Vulnerability
EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document...
EpicEditor XSS Vulnerability
EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document...
Angular Redactor XSS Vulnerability
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...
GHSA-88FH-8979-Q2RR Angular Redactor XSS Vulnerability
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...
GHSA-G78H-PF65-46RV Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
The Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a...
Moodle XSS Vulnerability
Multiple cross-site scripting XSS vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 alt or 2 title attribute in an IMG element...