WordPress WP Compress plugin <= 6.20.01 - Open Redirect via css vulnerability

Open Redirect via css vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Compress versions = 6.20.01...

CSS Exfil Protection 安全漏洞

CSS Exfil Protection is a browser plugin from the individual developer Mike Gualtieri. A security vulnerability exists in CSS Exfil Protection version v.1.1.0, which stems from a lack of support for CSS variables and allows an attacker to obtain sensitive information...

CSS Exfil Protection 安全漏洞

CSS Exfil Protection is a browser plugin from the individual developer Mike Gualtieri. A security vulnerability exists in CSS Exfil Protection version v.1.1.0, which stems from a lack of support for CSS style rules and could allow a remote attacker to obtain sensitive information...

Fedora: Security Advisory for liblayout (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: liblayout-0.2.10-36.fc40

LibLayout is a layouting framework. It is based on the Cascading StyleSheets standard. The layouting expects to receive its content as a DOM structure although it does not rely on the W3C-DOM API...

[SECURITY] Fedora 40 Update: flute-1.3.0-37.OOo31.fc40

A Cascading Style Sheets parser using the Simple API for CSS, for Java...

BIT-GITLAB-2022-2307

A lack of cascading deletes in GitLab CE/EE affecting all versions starting from 13.0 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious Group Owner to retain a usable Group Access Token even after the Group is deleted,...

Update your browser: Security fixes for latest Chrome zero-day

News, Security Update your browser: Security fixes for latest Chrome zero-day Share December 22nd, 2023 Hi everyone! The latest patches to the Opera, Opera GX, Opera Crypto, and Opera for Android browsers address several recent vulnerabilities, including a zero-day exploit CVE-2023-7024. We...

The vulnerability of Google Chrome’s CSS component allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s CSS component is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created malicious web page...

DEBIAN-CVE-2023-6707

Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

PT-2023-32551 · WordPress · Mainwp Dashboard

Name of the Vulnerable Software and Affected Versions: MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress versions up to, and including, 4.5.1.2 Description: The issue allows authenticated attackers with administrator-level access to inject arbitrary CSS...

PT-2023-7683 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 120.0.6099.109 Description: The issue is related to a use after free in CSS, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to unauthorized...

The vulnerability in the cr parser_parse_any_core function of the cr-parser.c library, which is used for working with cascade CSS2 Libcroco tables, allows a attacker to compromise the integrity of data and also cause service failures.

The vulnerability of the cr parserparseanycore function in the cr-parser.c library, which is used for working with cascading CSS2 Libcroco tables, is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to compromise data integrity and cause service...

The vulnerability in the cr parser_parse_selector_core function of the cr-parser.c library, used for working with cascade CSS2 Libcroco tables, allows a attacker to cause a service failure.

The vulnerability of the cr parserparseselectorcore function in the cr-parser.c component, a library for working with cascading CSS tables, is related to the execution of a loop with an unavailable exit condition. Exploiting this vulnerability could allow a malicious actor to cause service failur...

WordPress Plugin Custom CSS, JS & PHP Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

golang: html/template: improper sanitization of CSS values

A flaw was found in golang where angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if...

Cross-site Scripting (XSS)

Overview sanitize is a Ruby HTML and CSS sanitizer. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient neutralization of style element content. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS when the library is...

AZL-26614 CVE-2023-24539 affecting package golang for versions less than 1.20.7-1

Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...

Pimcore 路径遍历漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce frameworks and product information management applications. A path traversal vulnerability exists in Pimco...

N.K. Hackers Employ Matryoshka Doll-Style Cascading Supply Chain Attack on 3CX

The supply chain attack targeting 3CX was the result of a prior supply chain compromise associated with a different company, demonstrating a new level of sophistication with North Korean threat actors. Google-owned Mandiant, which is tracking the attack event under the moniker UNC4736 , said the...