772 matches found
PT-2024-20928 · Unknown · Firebear Improved Import/Export
Name of the Vulnerable Software and Affected Versions: FireBear Improved Import And Export version 3.8.6 Description: A XSLT Server Side injection vulnerability in the Import Jobs function allows attackers to execute arbitrary commands via a crafted XSLT file. The vulnerability can be exploited b...
PT-2023-31917 · Unknown · Winter Cms
Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.4 Description: The issue concerns a Local File Inclusion vulnerability in Winter CMS, a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can...
The vulnerability of the CSS parser for Node.js’s css-tools arises from insufficient validation of input data, allowing attackers to trigger a service failure.
The vulnerability of the CSS parser for Node.js’s css-tools is related to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to cause service failures...
CVE-2023-46214
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations XSLT that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance...
PostCSS line return parsing error
An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets CSS. There may be \r discrepancies, as demonstrated by @font-face font:\r/; in a rule. This vulnerability affects linters using PostCSS to parse external untrusted CSS. An...
The vulnerability of the Google Chrome browser’s CSS component allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the Google Chrome browser’s CSS component is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
CVE-2023-29206
XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a...
Design/Logic Flaw
XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a...
CVE-2023-29206 org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins
XWiki Commons are technical libraries common to several other top level XWiki projects. There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a...
CVE-2023-29206
CVE-2023-29206 affects XWiki Commons where an author without Script rights could craft a script via a JavaScript xobject or StyleSheet xobject added to a document. The issue stems from missing permission checks, allowing such objects to execute under insufficient rights. Red Hat and other sources...
GHSA-CMVG-W72J-7PHX org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins
Impact There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing by a user with appropriate...
PT-2023-22203 · Xwiki · Xwiki
Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 14.9-rc-1 Description: The issue arises from the lack of checks on the author of a JavaScript xobject or StyleSheet xobject added to a XWiki document. This allowed a user with only Edit Right to create such an object a...
CVE-2022-48430
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview...
Design/Logic Flaw
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview...
CVE-2022-48430
Vulnerability CVE-2022-48430 affects JetBrains IntelliJ IDEA prior to 2023.1. The issue allows disclosing file content via an external stylesheet path used in Markdown preview, due to the way the preview handles stylesheet references. Impact: potential exposure of local file contents (confidentia...
CVE-2022-48430
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview...
JetBrains IntelliJ IDEA 安全漏洞
JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from the Czech company JetBrains. A security vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2023.1, which stems from a file content that can lead to path disclosure via an external...
PT-2023-15774 · Jetbrains · Intellij Idea
Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2023.1 Description: The issue allows file content to be disclosed via an external stylesheet path in Markdown preview. Recommendations: For versions prior to 2023.1, update to version 2023.1 or later ...
Dassault Systèmes ENOVIA Live Collaboration V6R2013xE 代码注入漏洞
Dassault Systèmes ENOVIA Live Collaboration V6R2013xE is a Product Lifecycle Management PLM software from Dassault Systèmes, France. A security vulnerability exists in Dassault Systèmes ENOVIA Live Collaboration V6R2013xE version to V6R2013xE FP version, which stems from the discovery of an XSL...
