PT-2022-18976

Name of the Vulnerable Software and Affected Versions OWASP AntiSamy versions prior to 1.6.6 Description The issue allows for XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets CSS content. This is a...

OWASP AntiSamy 跨站脚本漏洞

OWASP AntiSamy is a library for HTML and CSS coding from the US-based Owasp Foundation. A security vulnerability exists in OWASP AntiSamy versions prior to 1.6.7, which arises from an output serializer that does not properly encode assumed Cascading Style Sheet CSS content...

CVE-2022-29577: Improper Neutralization of Input During Web Page Generation

OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets CSS content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367...

CVE-2022-28367: Improper Neutralization of Input During Web Page Generation

OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets CSS content...

Windows LSA Protection Status

The LSA Protection validates users for local and remote sign-ins and enforces local security policies to prevent reading memory and code injection by non-protected processes. This provides added security for the credentials that the LSA stores and manages. This protects against Pass-the-Hash or...

PT-2022-5409 · Owasp · Owasp Antisamy

Name of the Vulnerable Software and Affected Versions: OWASP AntiSamy versions prior to 1.6.7 Description: The issue is related to the incorrect encoding of Cascading Style Sheets CSS content, allowing for HTML tag smuggling on STYLE content with crafted input. This can lead to cross-site scripti...

Remote code injection in dompdf/dompdf

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

Fedora: Security Advisory for pandoc-citeproc (FEDORA-2022-1f981071eb)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2022-28368

Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets CSS statement within an HTML input file...

[SECURITY] Fedora 34 Update: pandoc-citeproc-0.17.0.1-5.fc34

The pandoc-citeproc library supports automatic generation of citations and a bibliography in pandoc documents using the Citation Style Language CSL macro language. More details on CSL can be found at . In addition to a library, the package includes an executable, pandoc-citeproc, which works as a...

Design/Logic Flaw

Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cranelift. There is a use after free vulnerability in Wasmtime when both running Wasm that uses externrefs and enabling epoch interruption in Wasmtime. If you are not explicitly enabling epoch interruption it is disabled by default...

[SECURITY] Fedora 36 Update: gtkspell3-3.0.10-12.fc36

GtkSpell provides word-processor-style highlighting and replacement of misspelled words in a GtkTextView widget as you type. Right-clicking a misspelled word pops up a menu of suggested replacements...

[SECURITY] Fedora 36 Update: gtkspellmm30-3.0.5-17.fc36

GtkSpell provides word-processor-style highlighting and replacement of misspelled words in a GtkTextView widget as you type. Right-clicking a misspelled word pops up a menu of suggested replacements...

Design/Logic Flaw

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

CVE-2022-24719 Unauthorized forwarding of confidential headers in fluture-node

Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using followRedirects or followRedirectsWith with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie,...

CVE-2022-24719

CVE-2022-24719 affects Fluture-Node. The vulnerability arises when using followRedirects or followRedirectsWith with redirection strategies in fluture-node 4.0.0/4.0.1, where confidential headers (Authorization, Cookie) can be exposed in a redirected request to a third‑party or HTTP origin. The i...

WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress plugin <= 2.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Multicollab – Google Doc-Style Editorial Commenting for WordPress plugin versions = 2.0.3. Solution Update the WordPress Multicollab – Google Doc-Style Editorial Commenting plugin to the latest available version at least 2.0.4...

CVE-2017-0371

MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attrtitle url;" attack within a DIV element that has an attacker-controlled URL in the title attribute...