3842 matches found
Qualys Web Application Cross-Site Scripting Vulnerability
Qualys Web Application is a web application from Qualys, Inc. A cross-site scripting vulnerability exists in Qualys Web Application versions prior to 10.24.0.0, which arises from a lack of HTML coding when presenting logging information to a user, allowing a user with login access to the...
DoraCMS 安全漏洞
DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...
SUSE CVE-2023-6508
Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
The vulnerability of the Toolgate component in Parallels Desktop hypervisor allows a hacker to execute arbitrary code and increase their privileges.
The vulnerability of the Toolgate supervisor in Parallels Desktop is related to errors in XML request processing. Exploiting this vulnerability allows an attacker to execute arbitrary code and increase their privileges...
The vulnerability of Siemens OPC UA Modeling Editor (SiOME) relates to incorrect restrictions on XML references to external objects, allowing attackers to gain unauthorized access to protected information.
The vulnerability of the Siemens OPC UA Modeling Editor SiOME is related to incorrect restrictions on XML references to external objects. Exploiting this vulnerability may allow an attacker to gain unauthorized access to protected information...
The vulnerability of the IBM Security Directory Server software lies in the improper limitation of XML references to external objects. This allows attackers to influence the confidentiality and accessibility of the protected information.
The vulnerability of the IBM Security Directory Server data storage and management software is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow an attacker to influence the confidentiality and accessibility of the protected information...
CVE-2023-48302 Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup Ctrl+Shift+V the...
The vulnerability of the Splunk Enterprise platform for operational analysis, related to errors in processing XML requests, allows a perpetrator to execute arbitrary code.
The vulnerability of the Splunk Enterprise platform for operational analysis is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
OpenCRX Security Vulnerabilities
openCRX is an open source Crm software. A security vulnerability exists in OpenCRX version 5.2.0, which originated from a vulnerability that allows attackers to perform HTML injection attacks via the Accounts Name field...
Adobe RoboHelp Security Vulnerability
Adobe RoboHelp is a software application from Adobe, Inc. Next-generation software for authoring and publishing help, strategy and knowledge base content. A security vulnerability exists in Adobe RoboHelp version 11.4 and prior versions, which stems from the presence of an XML External Entity...
The vulnerability of the microprogrammed software of IP cameras Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 arises from buffer overflows in the stack. This allows intruders to execute arbitrary code.
The vulnerability of the microprogrammed software for IP cameras Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 arises due to buffer overflows in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code upon...
CVE-2023-43755
Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to multiple instances of stack-based overflows. During the processing and parsing of certain fields in XML elements from incoming network request...
DEBIAN-CVE-2023-5996
Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2023-5309
Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations...
golang: html/template: improper handling of empty HTML attributes
A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...
GHSA-H8GC-PGJ2-VJM3 Django Denial-of-service in django.utils.text.Truncator
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars and words methods when used with html=True are subject to a potential DoS denial of service attack via certain inputs with very long, potentially malformed HTML text. The chars and words...
DEBIAN-CVE-2023-43665
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars and words methods when used with html=True are subject to a potential DoS denial of service attack via certain inputs with very long, potentially malformed HTML text. The chars and words...
The vulnerability of the Django web application framework, related to the inefficient complexity of regular expressions, allows attackers to trigger a service failure.
The vulnerability of the Django web application framework relates to regular expressions for text trimming, which have linear complexity in their reverse path computation, potentially leading to slow performance. Exploiting this vulnerability could allow a remote attacker to cause service...
LiquidFiles Security Vulnerability
Liquidfiles is a storage service for large-scale secure file transfer and sharing for companies and organizations from US-based Liquidfiles, Inc. A security vulnerability exists in LiquidFiles version 3.7.13 and prior versions that stems from the presence of HTML and SMTP injection issues...