Vulnerability of software programs with DOM functions to bypass CAPTCHA; ReCaptcha solvers that allow hackers to gain full control over the browser.

The vulnerability of DOM-based software for bypassing CAPTCHA systems is related to the lack of security measures taken to protect the structure of web pages. Exploiting this vulnerability can allow a hacker to gain full control over the browser...

The vulnerability of the Mozilla Firefox browser, related to information representation errors, allows attackers to perform spear-phishing attacks.

The vulnerability of the Mozilla Firefox browser is related to errors in the object model representation of documents. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

DEBIAN-CVE-2021-33813

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request...

OESA-2021-1222 libxml2 security update

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

CVE-2017-17678

BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting XSS. A DOM-based cross-site scripting vulnerability was discovered in a legacy utility...

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

Dart 跨站脚本漏洞

Dart is an open source programming language. A cross-site scripting vulnerability exists in Dart SDK versions prior to 2.12.3, which can be exploited by attackers to use XSS attacks by hitting the DOM hard...

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

Rocket.Chat: Blind XSS

Blind XSS The page located at https://livechat.coinflex.com/livechat suffers from a Cross-site Scripting XSS vulnerability. XSS is a vulnerability which occurs when user input is unsafely encorporated into the HTML markup inside of a webpage. When not properly escaped an attacker can inject...

The vulnerability of Firefox, Firefox ESR, and the Thunderbird email client relates to the issue of operations beyond the buffer boundaries in memory when manipulating the DOM tree. This allows an attacker to execute arbitrary code.

The vulnerability of Firefox browsers, Firefox ESR, and the email client Thunderbird is related to the issue of operations going beyond the buffer in memory when manipulating the DOM tree. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created...

Insulet Corporation: DOM XSS on www.omnipod.com/freedom/birthdate-confirmation and www.omnipod.com/pif/thanks-freedom

The DOM-based XSS vulnerability was found on the www.omnipod.com/freedom/birthdate-confirmation and www.omnipod.com/pif/thanks-freedom pages. The vulnerability was triggered by crafting a URL with malicious code in the query parameters, which was then executed by the vulnerable script on the page...

The vulnerability of Firefox, Firefox ESR, and the Thunderbird email client relates to the use of memory after element manipulation in the DOM. This allows an attacker to trigger a service failure.

The vulnerability of Firefox browsers, Firefox ESR, and the email client Thunderbird relates to the use of memory after element manipulation in the DOM is released. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2020-7809

ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...

CVE-2020-5334

RSA Archer, versions prior to 6.7 P2 6.7.0.2, contains a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM...

Criminals hack Tupperware website with credit card skimmer

Update 2: A spokesperson for Tupperware has given a public statement to Alex Scroxton, Security Editor at ComputerWeekly. You can read it here. Update: Following our blog post, we continued to monitor the Tupperware website. As of 03/25 at 1:45 PM PT, we noticed that the malicious PNG file had be...

CVE-2020-6845

An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack...

CVE-2019-19757

An internal product security audit of Lenovo XClarity Administrator LXCA discovered a Document Object Model DOM based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The...

CVE-2017-11429

Clever saml2-js 2.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to...

prometheus: Stored DOM cross-site scripting (XSS) attack via crafted URL

A stored, DOM based, cross-site scripting XSS flaw was found in Prometheus. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts...

The vulnerability of the Cisco Web Security Appliance’s web interface allows a hacker to inject arbitrary code into the web page that is uploaded.

The vulnerability of the Cisco Web Security Appliance web interface relates to insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary code into the loaded web page through a specially crafted link using the DOM...