uint16 type for the facet position and selector position

Lines of code Vulnerability details Description In the Diamond library there is uint16 type used for the facet position and selector position in the FacetToSelectors and SelectorToFacet structs. That creates a restriction that the number of facets is limited by 2^16. In case when the number of...

Forma Learning Management System SQL注入漏洞

Forma Learning Management System LMS is a Learning Management System LMS. A security vulnerability exists in the Forma Learning Management System version 3.1.0, which originates from an SQl injection of the dynfilter parameter of the appLms/ajax.admserver.php?r=widget/userselector/getusertabledat...

Malicious Package

Overview docs-friend-selector is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Cross-site Scripting (XSS)

grapesjs is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the class name in ClassTagView.ts when it adds to the selector manager, allowing an attacker to inject and execute malicious javascript...

grapesjs before 0.19.5 vulnerable to Cross-site Scripting

The package grapesjs before 0.19.5 is vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

GHSA-589F-C66P-HXR4 grapesjs before 0.19.5 vulnerable to Cross-site Scripting

The package grapesjs before 0.19.5 is vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

CVE-2022-21802

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

CVE-2022-21802 Cross-site Scripting (XSS)

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

CVE-2022-21802 Cross-site Scripting (XSS)

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

grapesjs 跨站脚本漏洞

grapesjs is a free and open source Web Builder framework by Artur Arseniev Individual Developer, Italy. Helps to build HTML templates faster and easier for delivery in websites, newsletters or mobile applications u200bu200b. A security vulnerability exists in grapesjs versions prior to 0.19.5,...

CVE-2022-21802

The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager...

Cross-site Scripting (XSS)

oro/commerce is vulnerable to cross-site scripting. The vulnerability exists through the grapesjs dependency used in the library as it does not properly validate the class name in ClassTagView.ts when it adds to the selector manager, allowing an attacker to inject and execute malicious javascript...

OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor

Impact Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager Relates to - https://github.com/artf/grapesjs/issues/4411 Patch Update GrapeJS dependency to =v0.19.5...

GHSA-WGMR-MF83-7X4J Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service

Description Invalid HTTP/2 requests for example, invalid URIs are incorrectly handled by writing a blocking error response directly from the selector thread. If the client manages to exhaust the HTTP/2 flow control window, or TCP congest the connection, the selector thread will be blocked trying ...

Cross-site Scripting (XSS)

Overview grapesjs is a web builder framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to an improper sanitization of the class name in Selector Manager. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a...

Malicious code in ride-mode-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eeae94f35343e850853d2bd800623b392ca6eb1219179421042cf127de2082be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5795 Malicious code in ride-mode-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eeae94f35343e850853d2bd800623b392ca6eb1219179421042cf127de2082be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Imagemap Selector plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Imagemap Selector plugin, which stems from t...

GHSA-PFM2-MQWJ-GGM5 MediaWiki makeCollapsible allows applying event handler to any CSS selector

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...

MediaWiki makeCollapsible allows applying event handler to any CSS selector

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...