Design/Logic Flaw

An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size,...

CVE-2023-24620

An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size,...

CVE-2023-24620

An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size,...

CVE-2023-24620

An issue was discovered in Esoteric YamlBeans through 1.15. A crafted YAML document is able perform am XML Entity Expansion attack against YamlBeans YamlReader. By exploiting the Anchor feature in YAML, it is possible to generate a small YAML document that, when read, is expanded to a large size,...

CVE-2023-3434

Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami version 20222284 on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger...

CVE-2023-3434

Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami version 20222284 on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger...

Input validation

Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami version 20222284 on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger...

CVE-2023-3434 QRC Handler without Input Validation in Jami

Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami version 20222284 on Windows. This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger...

Jami 安全漏洞

Jami is an open source, SIP-compatible software telephony and instant messaging software from Jami, Inc. A security vulnerability exists in Jami version 20222284 that originates from a vulnerability that allows an attacker to send a custom HTML anchor tag that passes a string value to the Windows...

Open Redirect via deskDomain

Description This vulnerability occurs because the desired domain value can be inserted into the A tag through deskDomain manipulation. javascript if window.location.hash != null && window.location.hash.substring0, 9 == 'TICKETS' try var temp = JSON.parsedecodeURIComponent...

@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme

Impact Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content. Patches...

Cross-site Scripting (XSS)

@lexical/link is vulnerable to Cross-site Scripting XSS. The vulnerability exists because hrefs anchor tags aren't properly sanitized in the createDOM function of index.ts, allowing an attacker to inject and execute malicious JavaScript through the malicious URLs...

Cross site scripting

Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources...

CVE-2023-30792

Anchor tag hrefs in Lexical prior to v0.10.0 would render javascript: URLs, allowing for cross-site scripting on link clicks in cases where input was being parsed from untrusted sources...

CVE-2023-30792

The CVE-2023-30792 issue affects Meta Platforms Lexical versions prior to 0.10.0, where anchor tag hrefs render javascript: URLs when parsing input from untrusted sources, enabling cross-site scripting on link clicks. The vulnerability stems from unsanitized hrefs in anchor elements (createDOM pa...

PT-2023-22985 · Lexical · Lexical

Name of the Vulnerable Software and Affected Versions: Lexical versions prior to 0.10.0 Description: The issue allows cross-site scripting on link clicks when input is being parsed from untrusted sources, due to href attributes in anchor tags rendering javascript: URLs. Recommendations: For...

votes[to] mapping anchor time not adjusted correctly in Equity.adjustRecipientVoteAnchor() can lead to unexpected results

Lines of code Vulnerability details H-01 votesto mapping anchor time not adjusted correctly in Equity.adjustRecipientVoteAnchor can lead to unexpected results Proof of Concept Equity.solL161 function adjustRecipientVoteAnchoraddress to, uint256 amount internal returns uint256 if to != address0x0...

Bypass Stored XSS in Catalog

Login in URL : https://demo.pimcore.fun/admin 2. Go to File - Perspectives - Catalog 3. Click in tab Properties - footer - Open 4. click any Find & Order - Edit 5. in tab Basic, inject payload to : Prameters, Anchor in tab Advanced, inject payload to: Class For more understanding please check...

SUSE CVE-2008-4696

Cross-site scripting XSS vulnerability in Opera.dll in Opera before 9.61 allows remote attackers to inject arbitrary web script or HTML via the anchor identifier aka the "optional fragment", which is not properly escaped before storage in the History Search database aka md.dat...

SUSE CVE-2011-0482

Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of anchors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document...