85 matches found
GHSA-X7M8-JRM8-HPVX @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...
PT-2026-95998
Summary Embedded font-family names word/fontTable.xml were interpolated unescaped into an injected @font-face and into the print window's document.write. A crafted name injects page-wide CSS on open, and breaks out of into executable HTML on Print. Impact Opening a crafted .docx applies...
CVE-2026-72751 Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
CVE-2026-72751 Stored Cross-Site Scripting in CTI-Transmute Conversion Graph via Malicious STIX/MISP Content
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
PT-2026-69847
Name of the Vulnerable Software and Affected Versions CTI-Transmute affected versions not specified Description A stored cross-site scripting XSS issue exists in the conversion graph used to visualize MISP and STIX content. Attacker-controlled values from converted CTI data are passed to...
CVE-2026-72751: Improper Neutralization of Input During Web Page Generation
CTI-Transmute is affected by a stored cross-site scripting XSS vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI data were passed to multiple HTML-parsing sinks in the graph user interface without...
CVE-2026-40212: Improper Neutralization of Input During Web Page Generation
OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting XSS vulnerability in the console because document.write is used unsafely, which is relevant in scenarios where administrators use the console web interface to view instance console logs...
CVE-2017-20219: Improper Neutralization of Input During Web Page Generation
Serviio PRO 1.8 DLNA Media Streaming Server contains a DOM-based cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads. Attackers can craft URLs with malicious input that is read from document.location and passed to...
CVE-2025-63883: Improper Neutralization of Input During Web Page Generation
A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 Bhabishya-123/E-commerce. The site's client-side JavaScript reads attacker-controlled input for example, values derived from the URL or page fragment and inserts it into the DOM via unsafe sinks...
EUVD-2013-6438
Malware in sbrugna...
EUVD-2012-2879
Malware in sbrugna...
EUVD-2010-1207
Malware in sbrugna...
SUSE CVE-2010-3769
The line-breaking implementation in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, Thunderbird before 3.0.11 and 3.1.x before 3.1.7, and SeaMonkey before 2.0.11 on Windows does not properly handle long strings, which allows remote attackers to execute arbitrary code via a crafted...
Gnome Web (Epiphany) < 3.28.2.1 - Denial of Service
Title: Gnome Web/Epiphany Browser libephymain.so in GNOME WEB/Epiphany PoC: b1tch3z = window.open"https://www.google.com", "bl1ngbl1ng", "width=250,height=250"; b1tch3z.document.write"ua b1tch3z"; // https://github.com/undergroundagency // https://github.com/ldpreload Video PoC:...
CVE-2018-12016
libephymain.so in GNOME Web aka Epiphany through 3.28.2.1 allows remote attackers to cause a denial of service application crash via certain window.open and document.write calls...
CVE-2018-12016
libephymain.so in GNOME Web aka Epiphany through 3.28.2.1 allows remote attackers to cause a denial of service application crash via certain window.open and document.write calls...
CVE-2018-12016
libephymain.so in GNOME Web aka Epiphany through 3.28.2.1 allows remote attackers to cause a denial of service application crash via certain window.open and document.write calls...
CVE-2018-12016
libephymain.so in GNOME Web aka Epiphany through 3.28.2.1 allows remote attackers to cause a denial of service application crash via certain window.open and document.write calls...
CVE-2018-12016: Undefined Security Weakness
libephymain.so in GNOME Web aka Epiphany through 3.28.2.1 allows remote attackers to cause a denial of service application crash via certain window.open and document.write calls...