7502 matches found
CVE-2025-61994
Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page...
CVE-2025-43493
The issue was addressed with improved checks. This issue is fixed in Safari 26.1, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1. Visiting a malicious website may lead to address bar spoofing...
CVE-2025-43427
This issue was addressed through improved state management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, tvOS 26.1, visionOS 26.1. Processing maliciously crafted web content may lead to an unexpected process crash...
Apple多款产品 安全漏洞
website is a library from Challenge open source. Contains files for the new DIKULAN website not dependent on Joomla. A security vulnerability exists in several Apple products that stems from inconsistent management of user interface states, which may lead to user interface spoofing. The following...
Apple多款产品 安全漏洞
website is a library from Challenge open source. Contains files for the new DIKULAN website not dependent on Joomla. ch is a ClickHouse open source low-level Go client for ClickHouse. A security vulnerability exists in several Apple products that stems from the fact that accessing a malicious...
Use of Web Browser Cache Containing Sensitive Information
Overview Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to using an incorrect cache-control header. A local attacker can gain unauthorized access to previously downloaded files by retrieving them from the browser's cache...
Use of Web Browser Cache Containing Sensitive Information
Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Use of Web Browser Cache Containing Sensitive Information due to using an incorrect cache-control header. A local attacker can gain unauthorized access to previous...
Microsoft Edge 安全漏洞
Microsoft Edge is a web browser from Microsoft Corporation USA that comes with systems after Windows 10. A security vulnerability exists in Microsoft Edge that stems from an improper implementation of the auto-fill feature...
Microsoft Edge 安全漏洞
Microsoft Edge is a web browser from Microsoft Corporation USA that comes with systems after Windows 10. A security vulnerability exists in Microsoft Edge that stems from an improper implementation in an extension...
CVE-2025-62712
JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user can retrieve connection tokens belonging to other users via the super-connection API endpoint...
CVE-2025-61931
Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser...
CVE-2025-61931
Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser...
EUVD-2025-35655
Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted input is stored by an attacker with "ContentType Management" privilege, an arbitrary script may be executed on the web browser of the user who accesses Edit CategorySet of...
Hugging Face Smolagents XPath injection vulnerability in the search_item_ctrl_f function
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the searchitemctrlf function located in src/smolagents/visionwebbrowser.py. The function constructs an XPath query by directly concatenating user-supplied input into the XPath expression without proper sanitizatio...
CVE-2025-11844
Hugging Face Smolagents 1.20.0 has an XPath injection in search_item_ctrl_f (vision_web_browser.py) where user input is concatenated into XPath queries without sanitization, allowing attackers to modify query logic, bypass filters, and access unintended DOM elements, potentially disrupting AI web...
CVE-2025-52583
Reflected cross-site scripting XSS vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser...
CVE-2025-54760
A primary security issue is a Stored cross-site scripting (XSS) vulnerability in desknet’s NEO, affecting v9.0R2.0 and earlier, which could allow arbitrary JavaScript to run in a user’s browser. The CVE is corroborated by multiple sources (NVD/Red Hat/JVN/CVE records) noting the same description....
CVE-2025-52583
The CVE-2025-52583 entry describes a Reflected cross-site scripting (XSS) vulnerability in desknet’s Web Server that allows execution of arbitrary JavaScript in a user’s browser. The connected sources confirm the issue is tied to desknet’s Web Server and identify the impact as client-side script ...