CVE-2025-0244

When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. Note: This issue only affected Android operating systems. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 134...

CVE-2024-52834

Adobe Experience Manager (AEM) 6.5.21 and earlier is affected by a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields (CVE-2024-52834). Malicious JavaScript can execute in a victim’s browser when the page containing the vulnerable field is loaded. Connected sources confirm ...

CVE-2024-52854

Adobe Experience Manager (AEM) 6.5.21 and earlier are affected by a stored Cross‑Site Scripting (XSS) vulnerability in vulnerable form fields, allowing injected JavaScript to run in victims’ browsers. The issue is documented as CVE-2024-52854 with a MEDIUM severity (CVSS 3.1: 5.4). Connected sour...

CVE-2024-52841

CVE-2024-52841 affects Adobe Experience Manager (AEM) 6.5.21 and earlier. The issue is a stored Cross-Site Scripting (XSS) vulnerability in vulnerable form fields that allows attacker-supplied JavaScript to execute in a victim’s browser when visiting the affected page. The root cause is improper ...

CVE-2024-9672

A reflected cross-site scripting XSS vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

The vulnerability of the Apple GPU Driver affects browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird, allowing an attacker to execute arbitrary code.

The vulnerability of the Apple GPU Driver in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the “Open Executable File” window in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a perpetrator to execute arbitrary code.

The vulnerability of the “Open Executable File” window in browsers such as Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to incorrect event handling due to improper code generation. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

CVE-2022-1226 Cross-site Scripting (XSS) in phpipam/phpipam

A Cross-Site Scripting XSS vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include...

Sylius 安全漏洞

Sylius is a suite of open source e-commerce platforms based on the Symfony framework by the Polish company Sylius. A security vulnerability exists in Sylius. An attacker exploiting the vulnerability could execute malicious scripts in a user's browser...

The vulnerability of the user interfaces of Google Chrome and Microsoft Edge allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the user interfaces of Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information through a specially created...

CVE-2024-45116 Adobe Commerce | Cross-site Scripting (XSS) (CWE-79)

Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier are affected by a Cross-Site Scripting XSS vulnerability that could be exploited to execute arbitrary code. If an admin attacker can trick a user into clicking a specially crafted link or submitting a form, malicious...

The vulnerability of JavaScript script handlers in Microsoft Edge and Google Chrome browsers allows attackers to disclose protected information.

The vulnerability of JavaScript script handlers in Microsoft Edge and Google Chrome browsers is related to improper security checks for standard elements. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

@gambalabs/sentry-nuxt (>=8.31.1 <=8.32.0), @globalbrain/sefirot (=3.40.0) +26 more potentially affected by unknown CVE via @sentry/browser (>=8.0.0-alpha.2 <=8.32.0)

@sentry/browser NPM version =8.0.0-alpha.2, =8.31.1, =8.9.0, =1.0.386-leo-ron-885-experimental.35, =0.0.1, =0.1.0, =8.0.0, =8.0.0-alpha.2, =8.0.0, =1.0.0, =5.0.0, =8.0.0, =8.0.0, =8.0.0, =8.32.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-593M-55HH-J8GV...

GHSA-255W-87RH-RG44 Cross-site Scripting via uploaded SVG

In Sulu v2.0.0 through v2.6.4 are vulnerable against XSS whereas a low privileged user with an access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ other users including admins browsers...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability previously existed in Mozilla Firefox version 131, which stemmed from the inclusion of a memory security hole...

Dassault Systèmes 3DEXPERIENCE 安全漏洞

Dassault Systèmes 3DEXPERIENCE is a business and innovation platform from Dassault Systèmes France. A security vulnerability exists in Dassault Systèmes 3DEXPERIENCE, which originated. An attacker could exploit the vulnerability to execute arbitrary script code within a user's browser session...

CVE-2024-45799 Javascript Injection in Vending Info/Buyers Info Module in FluxCP

FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a...

The vulnerability of Firefox browsers, including Firefox ESR, arises from the absence of a confirmation dialog box when opening Usenet links such as “news:“ and “snews:“. This allows a malicious user to download any application and execute any code.

The vulnerability of Firefox and Firefox ESR lies in the absence of a confirmation dialog box when opening “news:“ and “snews:“ protocols related to Usenet. Exploiting this vulnerability allows an attacker to download arbitrary applications and execute arbitrary code...

IBM Notes Denial Of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "IBM Notes Denial Of Service", 'Description' = %q This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes. If...