Mozilla Thunderbird < 91.11

The version of Thunderbird installed on the remote Windows host is prior to 91.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-26 advisory. - The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showe...

Denial Of Service (DoS)

firefox is vulnerable to denial of service. The vulnerability exists during the navigations between XML documents causing a use-after-free which then leads an application crash...

Design/Logic Flaw

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious...

PT-2022-20500

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 13.9.99.111 Description The issue arises from the improper escaping of a document's title in the search result of the MyDocmanSearch widget and in the administration page of locked documents. This could allow a malicio...

Tuleap cross-site scripting vulnerabilities

Tuleap is an application lifecycle management system that facilitates agile software development, design projects, V-models, requirements management and IT service management.A cross-site scripting vulnerability exists in versions prior to Tuleap 13.9.99.111, which stems from a failure to properl...

PT-2022-11429 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.8.1 through 4.10.9 Description: The issue is related to a quadratic blowup in the Convert::xml2array function, which can be exploited via a crafted XML document to enable a remote attack...

SilverStripe Framework Resource Management Error Vulnerability

silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.8.1. An attacker can exploit this vulnerability to conduct remote attacks via specially crafted XML documents...

GHSA-QGHG-V7XV-Q98Q MantisBT XSS through crafted SVG documents in file_download.php

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...

MantisBT XSS through crafted SVG documents in file_download.php

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the filedownload.php process. An attacker can execute arbitrary JavaScript code by attaching and triggering malicious SVG documents. Details Cross-site scripting or...

CVE-2022-33910

CVE-2022-33910 affects MantisBT before 2.25.5. Affected area: attaching crafted SVG documents to issue reports or bugnotes. Root cause: file_download.php opens the SVG in a browser tab instead of downloading it as a file, enabling JavaScript execution in the context of the user’s browser. Impact:...

CVE-2022-33910: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, filedownload.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScri...

PDFTron SDK Code Execution

The vulnerability of the PDFTron SDK software’s library for viewing, printing, rendering, creating, and processing PDF files is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code in the context of the current...

MAL-2022-3578 Malicious code in head-dlb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c4e3fe4404a2dcb3ba9f86c02229e85e2bf8bceff38f5f7f0e00afec38faec7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb586cca0b2de02fff1057f548dba4887dd3b2ffaec498d2fb80432bef8ec9f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5989 Malicious code in search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d766a559ac60a5a49bdcf49f60e171420b152d4eb98b8f941c094927f0a5058 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d766a559ac60a5a49bdcf49f60e171420b152d4eb98b8f941c094927f0a5058 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @azure-tests/perf-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f2237723a6fdf9b67623ef054f822f99d0e07663d04182ba616f88121f800b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 593f8130bfe080437256f79540f957cb19721fc1caa66b41f5874e0f0fbcc80d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1375 Malicious code in azure-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 593f8130bfe080437256f79540f957cb19721fc1caa66b41f5874e0f0fbcc80d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...