72 matches found
CVE-2024-22640
TCPDF version =6.6.5 is vulnerable to ReDoS Regular Expression Denial of Service if parsing an untrusted HTML page with a crafted color...
PT-2024-19516 · Tcpdf +1 · Tcpdf +1
Name of the Vulnerable Software and Affected Versions: TCPDF versions = 6.6.5 Description: The issue concerns a ReDoS Regular Expression Denial of Service vulnerability that occurs when parsing an untrusted HTML page with a crafted color. This can lead to a denial of service. Recommendations: For...
CVE-2023-34623
A flaw was found in jtidy when parsing untrusted html. If the parser is running on unsanitized user input, an attacker could craft a request that causes the parser to crash by stack overflow, resulting in a denial of service DoS. Mitigation This flaw can be mitigated by implementing sanitization...
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...
SUSE CVE-2020-11022
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...
Google Chrome 缓冲区错误漏洞
Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome versions 70.0.3538.67 through 101.0.4951.67, which originates from a boundary error when handling untrusted HTML content in DevTools. A remote attacker can exploit this vulnerability to perform a...
Google Chrome 缓冲区错误漏洞
Google Chrome is a web browser from Google, Inc.V8 is one of the open source JavaScript engines. A security vulnerability exists in Google Chrome due to a boundary error when handling untrusted HTML content in the WebUI. A remote attacker can create a specially crafted web page, trick a victim in...
CVE-2021-44030
Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery...
Quest KACE Desktop Authority 跨站脚本漏洞
Quest KACE Desktop Authority is a desktop management software from Quest, Inc. A cross-site scripting vulnerability exists in Quest KACE Desktop Authority, which can be exploited by remote attackers to submit special requests that can cause untrusted HTML to reach jQuery's jQuery. htmlPrefilter...
Exploit for Cross-site Scripting in Jquery
CVE-2020-11022 CVE-2020-11023 In jQuery versions greater th...
PT-2021-7917
Name of the Vulnerable Software and Affected Versions jsoup versions prior to 1.14.2 Description The issue is related to the parsing of untrusted HTML or XML, which may cause the parser to get stuck, complete more slowly than usual, or throw an unexpected exception, potentially supporting a denia...
Denial Of Service
chromium is vulnerable to denial of service. The vulnerability exists due to a boundary error when processing untrusted HTML content in Tab Groups. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code o...
BSA-2020-972
Security Advisory ID : BSA-2020-972 Component : jQuery Revision : 1.0 In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untruste...
Google Chrome heap buffer overflow vulnerability (CNVD-2021-31243)
Chrome is a simple and efficiently designed web browsing tool developed by Google that is characterized by its simplicity and speed. A security vulnerability exists in Google Chrome that stems from a boundary error in the V8 browser engine when handling untrusted HTML content. No detailed...
[SECURITY] [DLA 2608-1] jquery security update
Debian LTS Advisory DLA-2608-1 [email protected] https://www.debian.org/lts/security/ Roberto C. Sánchez March 25, 2021 https://wiki.debian.org/LTS Package : jquery Version : 3.1.1-2+deb9u2 CVE ID : CVE-2020-11022 CVE-2020-11023 Two vulnerabilities have been discovered in jquerys handli...
Debian DLA-2608-1 : jquery security update
Two vulnerabilities have been discovered in jquery's handling of untrusted HTML which may result in execution of untrusted code. For Debian 9 stretch, these problems have been fixed in version 3.1.1-2+deb9u2. We recommend that you upgrade your jquery packages. For the detailed security status of...
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...
VulnCheck KEV: CVE-2020-11022
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...