433 matches found
CVE-2020-26198
Dell EMC iDRAC9 versions prior to 4.32.10.00 and 4.40.00.00 contain a reflected cross-site scripting vulnerability in the iDRAC9 web application. A remote attacker could potentially exploit this vulnerability to run malicious HTML or JavaScript in a victim’s browser by tricking a victim in to...
CVE-2020-26198
Dell EMC iDRAC9 is affected by a reflected cross-site scripting (XSS) vulnerability in the web UI for versions prior to 4.32.10.00 and 4.40.00.00. A remote attacker could lure a victim to a crafted link to execute malicious HTML/JavaScript in the browser. Public references indicate the vulnerabil...
Arbitrary Code Execution
chromium is vulnerable to arbitrary code execution. Insufficient checks of pointer validity in WebRTC allows a remote attacker to exploit a heap corruption and execute arbitrary code on the host OS via a malicious HTML page...
squid: Improper input validation in request allows for proxy manipulation
A flaw was found in squid. The absolute URL of a request can include the decoded UserInfo username and password for certain protocols. This decoded info may contain special characters to delimit the domain, and treat the rest of the URL as a path or query string. An attacker could first make a...
CVE-2020-15930
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag...
CVE-2020-12853: Improper Neutralization of Input During Web Page Generation
Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal folders or accessible cells...
CVE-2020-5334
RSA Archer, versions prior to 6.7 P2 6.7.0.2, contains a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM...
The vulnerability of Google Chrome’s browser-based music acquisition mechanism allows attackers to gain unauthorized access to confidential data, cause service interruptions, and compromise data integrity.
The vulnerability of Google Chrome’s browser-music acquisition mechanism is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential data, cause service failures, and compromise data integrity through the...
DEBIAN-CVE-2019-12520
An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo...
The vulnerability of the Omnibox mechanism in the Google Chrome browser, related to the lack of a mechanism for checking entered data, allows a perpetrator to compromise the integrity of the data.
The vulnerability of the Omnibox mechanism in the Google Chrome browser is related to the lack of a mechanism for verifying the entered data. Exploiting this vulnerability allows an attacker to manipulate the integrity of data by creating a malicious HTML page...
The vulnerability of Google Chrome’s mechanism for processing external browser protocols lies in the lack of a mechanism for checking entered data. This allows attackers to compromise the integrity of the data.
The vulnerability of Google Chrome’s mechanism for processing external browser protocols is related to the lack of a mechanism for checking entered data. Exploiting this vulnerability allows an attacker to influence the integrity of data by creating a malicious HTML page...
Arbitrary Code Execution
thunderbird/firefox is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed HTML content. Malicious HTML content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird...
Arbitrary Code Execution
thunderbird is vulnerable to arbitrary code execution. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running...
ZOHO ManageEngine Desktop Central Code Execution Vulnerability
ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management. A security...
CVE-2019-19336
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the...
CVE-2019-19336
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the...
Cross site scripting
SilverStripe through 4.4.x before 4.4.5 and 4.5.x before 4.5.2 allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS Cross-Site Scripting on some forms buil...
CVE-2019-15614: Improper Neutralization of Input During Web Page Generation
Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files...
CVE-2019-19336
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session...