7652 matches found
PT-2021-16052
Name of the Vulnerable Software and Affected Versions Alojapro Widget WordPress plugin versions 1.1.15 and earlier Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to improper sanitization of Custom CSS settings, even when the unfiltered html capabilit...
PT-2021-16154
Name of the Vulnerable Software and Affected Versions OMGF WordPress plugin versions prior to 4.5.4 Description The issue allows unauthenticated users to perform path traversal and overwrite arbitrary CSS files with Google Fonts CSS, or download fonts uploaded on the Google Fonts website, due to...
WordPress plugin cross-site scripting vulnerabilities
WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress plugin Alojapro Widget 1.1.15 and earlier versions, which stems from the plugin not properly cleaning up its custom CSS settings, allowing an elevated privilege user t...
CVE-2021-24530: Improper Neutralization of Input During Web Page Generation
The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
WordPress plugin path traversal vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. The OMGF WordPress plugin suffers from a path...
PT-2021-21939
Name of the Vulnerable Software and Affected Versions: nth-check versions affected versions not specified Description: The issue is related to Inefficient Regular Expression Complexity, specifically a Regular Expression Denial of Service ReDoS vulnerability. This vulnerability causes a denial of...
axialvent.ru Cross Site Scripting vulnerability OBB-2141816
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-19157: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting CSS in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucenter&a=index'...
Inefficient Regular Expression Complexity in fb55/nth-check
Description I would like to report a Regular Expression Denial of Service ReDoS vulnerability in nth-check. It allows cause a denial of service when parsing crafted invalid CSS nth-checks. The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern \s?:+-?\s\d+? with quantified...
Inefficient Regular Expression Complexity in clean-css/clean-css
✍️ Description It allows cause a denial of service when calling function isDataUriResource. 🕵️♂️ Proof of Concept // PoC.js var isDataUriResource = require"clean-css/lib/utils/is-data-uri-resource" forvar i = 1; i = 50000; i++ var time = Date.now; var attackstr = 'data:' +...
minify:minify-css: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5984125270491136 Project: minify Fuzzing Engine: libFuzzer Fuzz Target: minify-css Job Type: libfuzzerasanminify Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x62d00000a400 Crash State: NULL Sanitizer: address ASAN Recommended...
WordPress cross-site scripting vulnerability
WordPress is the WordPress Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.A cross-site scripting vulnerability exists in Wordpress Plugin Highlight, which stems from the...
CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...
DEBIAN-CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...
CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...
CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...
Code injection
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...
CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...
UBUNTU-CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...
CVE-2021-30884
The issue was resolved with additional restrictions on CSS compositing. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. Visiting a maliciously crafted website may reveal a user's browsing history...