7758 matches found
Updated libcroco packages fix security vulnerability
Updated libcroco packages fix security vulnerabilities: Heap overflow input: check end of input before reading a byte CVE-2017-7960. Undefined behavior tknzr: support only max long rgb values CVE-2017-7961. Denial of service memory allocation error via a crafted CSS file CVE-2017-8834. Denial of...
budgethotels.sg Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1038308 Security Researcher devl00p Helped patch 2887 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting budgethotels.sg website...
Google Chrome API Disclosure
The vulnerability of the API implementation in Google Chrome’s CSS Paint technology lies in the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information through a specially created HTML page...
Google Chrome Blink Resource Management Error Vulnerability (CNVD-2019-44527)
Google Chrome is a Web browser from Google, a U.S. company. Blink is a browser layout engine rendering engine jointly developed by Google and Norway's OperaSoftware. A resource management error vulnerability exists in the 'WebCore::CSSSelector' function of Blink in Google Chrome prior to version...
Input validation
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a cssheroaction=editpage request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in th...
CVE-2019-19133
The CVE covers a reflected XSS in the WordPress CSS Hero plugin up to version 4.0.3, caused by insufficient sanitization of user input in the URI when csshero_action=edit_page is used. An authenticated attacker could trigger arbitrary JavaScript in the victim’s browser on the affected site, poten...
CVE-2019-19133
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a cssheroaction=editpage request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in th...
EulerOS 2.0 SP2 : libcroco (EulerOS-SA-2019-2520)
According to the versions of the libcroco package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The crtknzrparsecomment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service memory allocation error...
WordPress CSS Hero 4.0.3 Cross Site Scripting
Team, Document Title =============== CVE-2019-19133 Reflected XSS in CSS Hero = v.4.0.3 WordPress plugin. Product Description =============== CSS Hero WordPress Plugin A live WordPress Theme editor that works without modifying any of your theme files. Very low performance footprint: only generate...
CVE-2019-19133: Improper Neutralization of Input During Web Page Generation
The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a cssheroaction=editpage request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in th...
PT-2019-15774
Name of the Vulnerable Software and Affected Versions CSS Hero plugin versions prior to 4.0.4 Description The issue is related to reflected XSS via the URI in a csshero action=edit page request. It occurs because the plugin fails to sufficiently sanitize user-supplied input, allowing an attacker ...
WordPress CSS Hero plugin <= 4.03 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability found by Cary Hooper in WordPress CSS Hero plugin versions = 4.03. Solution Update the WordPress CSS Hero plugin to the latest available version at least 4.07...
KLA11611 Multiple vulnerabilities in Mozilla Firefox
Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Incorrectly image loading...
PT-2019-4864
Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 68.4 Firefox versions prior to 72 Description The issue arises when pasting a tag from the clipboard into a rich text editor, causing the CSS sanitizer to incorrectly rewrite a @namespace rule. This could lead to...
Denial Of Service (DoS) Through Infinite Loop
css-element-queries is vulnerable to denial of service DoS attacks. If an element is added to DOM and removed from DOM very quickly even before the first reset happens, the requestAnimationFrame of reset itself will get stuck in an infinite loop leading to denial of service conditions and memory...
CSS Hero < 4.07 - Authenticated Reflected XSS
The css-hero WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability...
EulerOS 2.0 SP8 : libcroco (EulerOS-SA-2019-2284)
According to the versions of the libcroco package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The crtknzrparsecomment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service memory allocation error...
CVE-2019-13714
Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an HTML page via a crafted URL...
DEBIAN-CVE-2019-13714
Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an HTML page via a crafted URL...
Input validation
Insufficient validation of untrusted input in Color Enhancer extension in Google Chrome prior to 78.0.3904.70 allowed a remote attacker to inject CSS into an HTML page via a crafted URL...