225 matches found
HCL Technologies HCL BigFix Platform 跨站脚本漏洞
HCL Technologies HCL BigFix Platform is a suite of endpoint security management platform from HCL Technologies, India. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in HCL Technologies HCL BigFix Platform version...
Jetbrains JetBrains IntelliJ IDEA 跨站脚本漏洞
JetBrains IntelliJ IDEA is a suite of integrated development environments for the Java language from the Czech company JetBrains. A cross-site scripting vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2022.1, which stems from injecting HTML into IDE messages...
The vulnerability of the jQuery library, related to the lack of measures taken to protect the structure of web pages, allows attackers to inject arbitrary web scripts or HTML code.
The vulnerability of jQuery software is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to inject arbitrary web scripts or HTML code remotely...
CVE-2020-13673
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...
CVE-2022-24682
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 update 1, as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing...
UBUNTU-CVE-2021-3816
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the groupprefix field during the creation of a new group via "Copy" method at usergroupadmin.php...
CVE-2020-23050
TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code...
CVE-2021-27673
Cross Site Scripting XSS in the "adminboxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component...
HTML Injection
Google Chrome is vulnerable to HTML injection. A remote attacker could perform a Dangling Markup Injection attack via a crafted HTML page due to the affected DevTools component...
Nextcloud: Reflected XSS / Markup Injection in `index.php/svg/core/logo/logo` parameter `color`
I just found a reflected Cross-Site Scripting XSS vulnerability in Nextcloud Server that affects current stable and dates back to at least 15.0.5. The vulnerability seems mitigated by a Content-Security-Policy CSP, but there might be a residual risk for phishing, due to the CSP's lack of a...
Microsoft Internet Explorer XML Injection Vulnerability
Microsoft Internet Explorer is a Web browser that comes with the Windows operating system. Microsoft Internet Explorer suffers from an XML injection vulnerability. An attacker could exploit this vulnerability to conduct XML injection attacks...
CVE-2019-7435
PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected HTML injection via the Search Form...
CVE-2019-5783
Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page...
DEBIAN-CVE-2019-5783
Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page...
CVE-2019-5783
Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page...
CVE-2019-5783
Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page...
Design/Logic Flaw
Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page...
CVE-2019-5783
CVE-2019-5783 corresponds to an "insufficient validation of untrusted input" vulnerability in Google Chrome’s DevTools prior to version 72.0.3626.81. The flaw enables a remote attacker to perform a Dangling Markup Injection attack by delivering a crafted HTML page, as described in the public CVE ...
