CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

PT-2021-7040

Name of the Vulnerable Software and Affected Versions MISP version 2.4.136 Description The issue is related to a lack of input data sanitization in the app/View/GalaxyElements/ajax/index.ctp component of the MISP platform, which can be exploited to perform cross-site scripting XSS attacks...

PT-2020-18971

Name of the Vulnerable Software and Affected Versions Opera for Android versions below 61.0.3076.56532 Description The issue arises when URLs using javascript: are pasted into the address bar. Normally, the protocol is removed to protect against cross-site scripting XSS attacks. However, in certa...

Opera Software Opera Cross-Site Scripting Vulnerability

Opera Software Opera is a Norwegian web browser from Opera Software that supports multi-window browsing, customizable user interface, and other features. A cross-site scripting vulnerability exists in Opera for Android versions below 61.0.3076.56532, which stems from a protocol that deletes url's...

Multiple Content Injection Vulnerabilities in marked

Versions 0.3.0 and earlier of marked are affected by two cross-site scripting vulnerabilities, even when sanitize: true is set. The attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs. Recommendation Upgrade to version 0.3.1 or later...

DEBIAN-CVE-2014-3743

Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's...

UBUNTU-CVE-2014-3743

Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's. sanitize: true Even if this option is set, marked is vulnerable to...

CVE-2014-3743

Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's. sanitize: true Even if this option is set, marked is vulnerable to...

CVE-2014-3743

Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's...

CVE-2014-3743

Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's...

PT-2020-7609

Name of the Vulnerable Software and Affected Versions marked versions 0.3.0 and earlier Description The issue affects versions of the marked software, allowing for cross-site scripting attacks through GFM Codeblocks and JavaScript URLs, even when the sanitize option is set to true. Recommendation...

CVE-2014-3743: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2 javascript url's...

PT-2020-7656

Name of the Vulnerable Software and Affected Versions Marked module versions prior to 0.3.1 Description Multiple cross-site scripting XSS vulnerabilities in the Marked module allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 gfm codeblocks language or 2...

chromium-browser: CSP bypass with Javascript URLs

Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page...

openSUSE Security Update : chromium (openSUSE-2019-1062)

This update for chromium to version 73.0.3683.75 fixes the following issues : Security issues fixed bsc1129059 : - CVE-2019-5787: Fixed a use after free in Canvas. - CVE-2019-5788: Fixed a use after free in FileAPI. - CVE-2019-5789: Fixed a use after free in WebMIDI. - CVE-2019-5790: Fixed a heap...

openSUSE Security Update : chromium (openSUSE-2019-343)

This update for chromium to version 73.0.3683.75 fixes the following issues : Security issues fixed bsc1129059 : - CVE-2019-5787: Fixed a use after free in Canvas. - CVE-2019-5788: Fixed a use after free in FileAPI. - CVE-2019-5789: Fixed a use after free in WebMIDI. - CVE-2019-5790: Fixed a heap...

PYSEC-2018-12

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...

CVE-2018-19787

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...