4089 matches found
Command Injection
Overview ng-packagr is a Compile and package a TypeScript library to Angular Package Format Affected versions of this package are vulnerable to Command Injection via the styleIncludePaths option. Remediation Upgrade ng-packagr to version 10.1.1 or higher. References - GitHub Commit Credit: Snyk...
DEBIAN-CVE-2020-6539
Use after free in CSS in Google Chrome prior to 84.0.4147.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...
chicagomanualofstyle.org Cross Site Scripting vulnerability OBB-1316171
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
ALSA-2020:3654 Moderate: libcroco security update
The libcroco is a standalone Cascading Style Sheet level 2 CSS2 parsing and manipulation library. Security Fixes: libcroco: Stack overflow in function crparserparseanycore in cr-parser.c CVE-2020-12825 For more details about the security issues, including the impact, a CVSS score, acknowledgments...
londontokyostyle.com Cross Site Scripting vulnerability OBB-1312119
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
vBulletin Cross-Site Scripting Vulnerability (CNVD-2020-50936)
vBulletin is a suite of forum programs that can be customized to suit your needs. A cross-site scripting vulnerability exists in the Admin CP in vBulletin 5.6.3. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the Style Manager's Style Options Settin...
CVE-2020-25118
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager...
CVE-2020-25118
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager...
Design/Logic Flaw
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager...
CVE-2020-25118
The CVE-2020-25118 entry relates to vBulletin 5.6.3 Admin CP, where the Style Options Settings Title in Styles Manager is susceptible to XSS. Affected component is the Admin CP’s Styles Manager Style Options Settings heading, with the underlying issue enabling cross-site scripting. The NVD provid...
PT-2020-21403
Name of the Vulnerable Software and Affected Versions marky-markdown versions all versions Description The issue concerns HTML Injection due to the failure to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML...
CVE-2020-25118: Improper Neutralization of Input During Web Page Generation
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager...
Hackers Exploit Autodesk Flaw in Recent Cyberespionage Attack
Threat actors exploited a vulnerability in the popular 3D computer graphics Autodesk software in order to launch a recent cyber-espionage attack against an international architectural and video production company. Researchers said that further analysis of the attack points to a sophisticated,...
What to expect when you're electing: The building blocks of disinformation campaigns
By Nick Biasini, Kendall McKay and Matt Valites. As Cisco Talos discovered during our four-year investigation into election security, securing elections is an extremely difficult, complex task. In the first paper in our election series, “What to expect when you’re electing,” Talos outlined how th...
free-style-company.biz Cross Site Scripting vulnerability OBB-1275446
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
GHSA-3J95-FJV2-3M4P CSS Injection in Chartkick gem
The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets CSS Injection without attribute...
CVE-2020-16254
The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets CSS Injection without attribute...
Code injection
The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets CSS Injection without attribute...
PT-2020-6862
Name of the Vulnerable Software and Affected Versions OpenSSL affected versions not specified Description A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve...
GHSA-VJV6-GQ77-3MJW XXE attack in Mapfish Print
Impact A user can do to an XML External Entity XXE attack with the provided SDL style. Patches Use version = 3.24 Workarounds No References https://cwe.mitre.org/data/definitions/611.html https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more...