13340 matches found
GHSA-663W-2XP3-5739 org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
Impact The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute names. This can be exploited, e.g., via the link syntax in any content that supports XWiki syntax like commen...
igraph:read_pajek: Segv on unknown address in igraph_strvector_set_len
Project: https://github.com/igraph/igraph.git Detailed Report: https://oss-fuzz.com/testcase?key=6410115693281280 Project: igraph Fuzzing Engine: libFuzzer Fuzz Target: readpajek Job Type: libfuzzerasanigraph Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State:...
CVE-2023-34085
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...
CVE-2023-37908
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute...
Cross site scripting
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute...
Cross site request forgery (csrf)
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...
CVE-2023-37908 org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute...
CVE-2023-37908
The CVE affects XWiki Rendering (xwiki-rendering) where a change to attribute cleaning during XHTML rendering introduced in version 14.6-rc-1 allowed arbitrary HTML injection via invalid attribute names. This could enable XSS (e.g., via link syntax in content like comments) and, for privileged us...
CVE-2023-37908 org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability
XWiki Rendering is a generic Rendering system that converts textual input in a given syntax into another syntax. The cleaning of attributes during XHTML rendering, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid attribute...
CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...
CVE-2023-34085 User Attribute Disclosure via DynamoDB Data Stores
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...
CVE-2023-34085
CVE-2023-34085 describes a vulnerability where, if an AWS DynamoDB table is used for storing user attributes, an attacker can craft a request to retrieve another user’s attributes. The connected records corroborate this label and tie the issue to Ping Identity PingFederate and related disclosures...
Ping Identity PingFederate Security Vulnerability
Ping Identity PingFederate is a flagship software-based federation server in the United States. for identity management. Ping Identity PingFederate has a security vulnerability that stems from the ability to retrieve other users' attributes using maliciously crafted requests when AWS DynamoDB...
CVE-2023-34085: Exposure of Private Personal Information to an Unauthorized Actor
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request...
XWiki Rendering Cross-Site Scripting Vulnerability
XWiki Rendering is a general-purpose rendering system from the XWiki Foundation that converts text input from a given syntax wiki syntax, HTML, etc. to another syntax XHTML, etc.. A security vulnerability exists in XWiki Rendering, which stems from an attribute cleaning during XHTML rendering tha...
CVE-2023-5127 WP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible for authenticated attackers with...
CVE-2023-5127: Improper Neutralization of Input During Web Page Generation
The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible for authenticated attackers with...
PT-2023-24659
Name of the Vulnerable Software and Affected Versions AWS DynamoDB affected versions not specified Description The issue allows an attacker to retrieve the attributes of another user using a maliciously crafted request when an AWS DynamoDB table is used for user attribute storage. Recommendations...
PT-2023-31780 · WordPress · Wp Font Awesome
Name of the Vulnerable Software and Affected Versions: WP Font Awesome plugin for WordPress versions up to, and including, 1.7.9 Description: The issue is related to Stored Cross-Site Scripting via shortcodes due to insufficient input sanitization and output escaping on the icon user-supplied...