4089 matches found
GHSA-VJV6-GQ77-3MJW XXE attack in Mapfish Print
Impact A user can do to an XML External Entity XXE attack with the provided SDL style. Patches Use version = 3.24 Workarounds No References https://cwe.mitre.org/data/definitions/611.html https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e For more...
Microcin is here
In February 2020, we observed a Trojan injected into the system process memory on a particular host. The target turned out to be a diplomatic entity. What initially attracted our attention was the enterprise-grade API-like application programming interface programming style. Such an approach is n...
Google Chrome CSS Code Issue Vulnerability
Google Chrome is a web browser from Google, an American company. A security vulnerability exists in CSS in Google Chrome versions prior to 11.0.0.0. A remote attacker can exploit this vulnerability to cause heap corruption with the help of specially crafted HTML pages...
UBUNTU-CVE-2018-18624
Grafana 5.3.1 has XSS via a column style on the "Dashboard Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...
CVE-2018-18624
Grafana 5.3.1 has XSS via a column style on the "Dashboard Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...
CVE-2018-18624: Improper Neutralization of Input During Web Page Generation
Grafana 5.3.1 has XSS via a column style on the "Dashboard Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...
PT-2020-8638
Name of the Vulnerable Software and Affected Versions: Grafana versions prior to 7.0.0 Grafana version 5.3.1 Description: The issue is related to a XSS vulnerability via a column style on the "Dashboard Table Panel" screen. This problem exists due to an incomplete fix for a previous issue...
style-picks.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1177043 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
style-it.jp Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1172204 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
British Airline EasyJet Suffers Data Breach Exposing 9 Million Customers' Data
British low-cost airline EasyJet today admitted that the company has fallen victim to a cyber-attack, which it labeled "highly sophisticated," exposing email addresses and travel details of around 9 million of its customers. In an official statement released today, EasyJet confirmed that of the 9...
Heybbs has a universal password login vulnerability
HEYBBS is a front-end based on bootstrap+jq+css,back-end php+mysql development of micro-community programs. Heybbs has a universal password login vulnerability that can be exploited by attackers to obtain sensitive database information...
The vulnerability of the WordPress website content management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the integrity of data.
The vulnerability of the WordPress website content management system is related to an XSS attack that allows JavaScript to be injected into the STYLE code. Exploiting this vulnerability could enable a malicious actor to compromise the integrity of the data...
Updated mediawiki packages fix security vulnerability
Updated mediawiki packages fix security vulnerability: In MediaWiki before 1.31.7, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because...
Unkillable xHelper and a Trojan matryoshka
It was the middle of last year that we detected the start of mass attacks by the xHelper Trojan on Android smartphones, but even now the malware remains as active as ever. The main feature of xHelper is entrenchment — once it gets into the phone, it somehow remains there even after the user delet...
CVE-2020-10960
In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...
PT-2020-12630
Name of the Vulnerable Software and Affected Versions Deskpro versions prior to 2019.8.0 Description An issue was discovered in Deskpro that allows administrators to modify the helpdesk interface by editing /portal/api/style/edit-theme-set/template-sources theme templates, using TWIG as its...
Regular Expression Denial-of-Service (ReDoS)
bleach is vulnerable to regular expression denial of service ReDoS. The vulnerability exists when parsing style attributes through sanitizecss...
GHSA-VQHP-CXGC-6WMM regular expression denial-of-service (ReDoS) in Bleach
Impact bleach.clean behavior parsing style attributes could result in a regular expression denial of service ReDoS. Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean..., attributes='a': 'style'. Patches 3.1.4 Workarounds d...
