4695 matches found
CVE-2019-8233: Improper Neutralization of Input During Web Page Generation
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments...
PT-2019-18947
Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1 Description The issue allows an unauthenticated user to inject arbitrary JavaScript code due to the sanitization engine ignoring HTML comments. Recommendation...
Mozilla: Incorrect HTML parsing results in XSS bypass technique
A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...
DEBIAN-CVE-2011-0428
Cross Site Scripting XSS in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments...
Cross site scripting
Cross Site Scripting XSS in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments...
CVE-2011-0428
Cross Site Scripting XSS in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments...
CVE-2011-0428
Cross Site Scripting XSS in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments...
CVE-2011-0428
Cross Site Scripting XSS in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments...
Mozilla: Incorrect HTML parsing results in XSS bypass technique
A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...
CVE-2011-0428: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments...
PT-2019-6609
Name of the Vulnerable Software and Affected Versions ikiwiki versions prior to 3.20110122 Description The issue allows remote attackers to insert arbitrary JavaScript due to insufficient checking in comments, potentially leading to Cross Site Scripting XSS attacks. Recommendations For versions...
Mozilla: Incorrect HTML parsing results in XSS bypass technique
A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...
Mozilla: Incorrect HTML parsing results in XSS bypass technique
A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...
Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments
Impact Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios. Patches The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later. Workarounds Disable Go Modules support. References Blog post:...
GHSA-V7X3-7HW7-PCJG Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments
Impact Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios. Patches The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later. Workarounds Disable Go Modules support. References Blog post:...
PT-2019-20070
Name of the Vulnerable Software and Affected Versions Renovate versions prior to 19.38.7 Description Temporary repository tokens were leaked into Pull Requests comments during certain Go Modules update failure scenarios. Recommendations For versions prior to 19.38.7, upgrade to version 19.38.7 or...
Integer overflow
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service resource consumption via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer...
CVE-2019-17583
idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of service resource consumption via a query for many comments, as demonstrated by the admincp.php?app=comment&perpage= substring followed by a large positive integer...