7696 matches found
CVE-2021-23983
By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox 87...
Who has the fastest F1 website in 2021? Part 4
This is part 4 in a multi-part series looking at the loading performance of F1 websites. Not interested in F1? It shouldn't matter. This is just a performance review of 10 recently-built/updated sites that have broadly the same goal, but are built by different teams, and have different performanc...
Cross Site Scripting vulnerability allows injecting HTML code into table edits
h3. Issue Summary Cross Site Scripting vulnerability allows injecting HTML code into table edits h3. Steps to Reproduce Edit a page Then access the Insert macro 'Info' option. A new window will open, in which the Preview option must be selected. With the help of an intermediate proxy such as burp...
UBUNTU-CVE-2021-23983
By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox 87...
CVE-2021-23983
By causing a transition on a parent node by removing a CSS rule, an invalid property for a marker could have been applied, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Firefox 87...
Mozilla Firefox < 87.0
"The version of Firefox installed on the remote Windows host is prior to 87.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-10 advisory. - Mozilla developers Tyson Smith and Christian Holler reported memory safety bugs present in Firefox 86. Some of these...
PT-2021-15639
Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 87 Description: The issue arises when a transition is caused on a parent node by removing a CSS rule, leading to an invalid property being applied for a marker. This results in memory corruption and can cause a...
Google Chrome Memory Use After Free
The vulnerability of the Google Chrome browser’s CSS component is related to the use of a memory area after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...
@duetds/angular (>=5.0.2, <=5.0.3), @duetds/components (>=5.0.2, <=5.0.3) +2 more potentially affected by CVE-2021-23356 via kill-process-by-name (1.0.5)
kill-process-by-name NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on kill-process-by-name and may be impacted: - @duetds/angular =5.0.2, =5.0.2, =1.7.20, =5.0.2, =5.0.3 Source cves: CVE-2021-23356 Source advisory: OSV:GHSA-QC65-CGVR-9...
@duetds/angular (>=5.0.2, <=5.0.3), @duetds/components (>=5.0.2, <=5.0.3) +2 more potentially affected by CVE-2021-23356 via kill-process-by-name (1.0.5)
kill-process-by-name NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on kill-process-by-name and may be impacted: - @duetds/angular =5.0.2, =5.0.2, =1.7.20, =5.0.2, =5.0.3 Source cves: CVE-2021-23356 Source advisory: GHSA-QC65-CGVR-93P6...
Updated roundcubemail package fixes security vulnerability
This update fixes cross-site scripting XSS via HTML messages with malicious CSS content CVE-2021-26925...
@fluentui/token-pipeline (>=0.3.3, <=0.22.0), @inmotionnow/momentum-components (>=8.2.2-next.2, <=102.39.0) +7 more potentially affected by unknown CVE via style-dictionary (>=2.5.0, <=2.10.2)
style-dictionary NPM version =2.5.0, =0.3.3, =8.2.2-next.2, =1.0.2, =0.1.0, =0.0.2, =1.0.0, =8.1.3, =6.0.0, =8.2.2-next.2 Source cves: unknown CVE Source advisory: SNYK:JS-STYLEDICTIONARY-1080632...
@duetds/angular (>=5.0.2, <=5.0.3), @duetds/components (>=5.0.2, <=5.0.3) +2 more potentially affected by CVE-2021-23356 via kill-process-by-name (1.0.5)
kill-process-by-name NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on kill-process-by-name and may be impacted: - @duetds/angular =5.0.2, =5.0.2, =1.7.20, =5.0.2, =5.0.3 Source cves: CVE-2021-23356 Source advisory:...
KLA12091 Multiple vulnerabilities in Mozilla Firefox ESR
Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A memory safety vulnerability can be exploited to execute arbitrary code. 2. A...
KLA12092 Multiple vulnerabilities in Mozilla Thunderbird
Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A memory safety vulnerability can be exploited to execute arbitrary code. 2. A...
[SECURITY] Fedora 32 Update: roundcubemail-1.4.11-1.fc32
RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...
Roundcube Webmail < 1.4.11 XSS Vulnerability
Roundcube Webmail is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
CVE-2020-26973
The Mozilla Foundation Security Advisory describes this flaw as: Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. This could have been used as a sanitizer bypass...
Cross-site Scripting (XSS)
roundcube is vulnerable to cross-site scripting XSS. The vulnerability exists through specific CSS token sequences during HTML email rendering which allows an attacker to inject and execute arbitrary javascript...
