4856 matches found
CVE-2022-31103
Lettersanitizer is a DOM-based HTML email sanitizer. All versions below 1.0.2 are affected by a denial-of-service when processing the CSS at-rule @keyframes. The issue also affects React Letter via dependency on lettersanitizer. Root cause: improper handling of CSS at-rules in the sanitizer, lead...
CVE-2022-31103 Improper handling of CSS at-rules in lettersanitizer
lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...
lettersanitizer 代码问题漏洞
lettersanitizer is a DOM-based HTML email cleaner for in-browser email rendering. A denial of service vulnerability exists in lettersanitizer versions prior to 1.0.2. The vulnerability stems from a failure to properly handle incoming error messages and can be exploited by an attacker to cause a...
CVE-2022-29455
DOM-based Reflected Cross-Site Scripting XSS vulnerability in Elementor's Elementor Website Builder plugin = 3.5.5 versions...
CVE-2022-29455
DOM-based Reflected Cross-Site Scripting XSS vulnerability in Elementor's Elementor Website Builder plugin = 3.5.5 versions...
Cross site scripting
DOM-based Reflected Cross-Site Scripting XSS vulnerability in Elementor's Elementor Website Builder plugin = 3.5.5 versions...
CVE-2022-29455 WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability
DOM-based Reflected Cross-Site Scripting XSS vulnerability in Elementor's Elementor Website Builder plugin = 3.5.5 versions...
PT-2022-3505 · Elementor · Elementor Website Builder
Name of the Vulnerable Software and Affected Versions: Elementor Website Builder plugin versions prior to 3.5.6 Description: The issue is related to insufficient protection of the webpage structure, allowing a remote attacker to perform cross-site scripting. This is a DOM-based Reflected Cross-Si...
CVE-2022-2029
Cross-site Scripting XSS - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0...
Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies
Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...
GHSA-39CH-RG26-GMQ5 Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies
Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...
GHSA-G7PC-799Q-743F Magento DOM-based Cross-site scripting vulnerability
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution...
CVE-2022-29182
GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 inclusive are vulnerable to a Document Object Model DOM-based cross-site scripting attack via a pipeline run's Stage Details Graphs tab. It is possible for a malicious script on a attacker-hosted site to execute script tha...
Cross site scripting
GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 inclusive are vulnerable to a Document Object Model DOM-based cross-site scripting attack via a pipeline run's Stage Details Graphs tab. It is possible for a malicious script on a attacker-hosted site to execute script tha...
CVE-2022-29182
GoCD versions 19.11.0–21.4.0 are vulnerable to a DOM-based XSS in the Stage Details > Graphs tab. An attacker-hosted page can abuse the messaging channel between the parent page and the stage-graphs iframe to execute script in the user’s browser context, potentially exfiltrating session cookie...
CVE-2022-29182 DOM-based XSS in GoCD
GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 inclusive are vulnerable to a Document Object Model DOM-based cross-site scripting attack via a pipeline run's Stage Details Graphs tab. It is possible for a malicious script on a attacker-hosted site to execute script tha...
CVE-2022-29182 DOM-based XSS in GoCD
GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 inclusive are vulnerable to a Document Object Model DOM-based cross-site scripting attack via a pipeline run's Stage Details Graphs tab. It is possible for a malicious script on a attacker-hosted site to execute script tha...
Cyclos 4.14.7 - DOM Based Cross-Site Scripting Vulnerability
Exploit Title: Cyclos 4.14.7 - DOM Based Cross-Site Scripting XSS Exploit Author: Tin Pham aka TF1T of VietSunshine Cyber Security Services Vendor Homepage: https://www.cyclos.org/ Version: Cyclos 4.14.7 and prior Tested on: Ubuntu CVE : CVE-2021-31674 Description: Cyclos 4 PRO 4.14.7 and before...
Cyclos 4.14.7 - (groupId) DOM Based Cross-Site Scripting Vulnerability
Exploit Title: Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting XSS Exploit Author: Tin Pham aka TF1T of VietSunshine Cyber Security Services Vendor Homepage: https://www.cyclos.org/ Version: Cyclos 4.14.7 and prior Tested on: Ubuntu CVE : CVE-2021-31673 Description: A Dom-based Cross-sit...
Cyclos 4.14.7 Cross Site Scripting
Exploit Title: Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting XSS Date: 17/04/2021 Exploit Author: Tin Pham aka TF1T of VietSunshine Cyber Security Services Vendor Homepage: https://www.cyclos.org/ Version: Cyclos 4.14.7 and prior Tested on: Ubuntu CVE : CVE-2021-31673 Description: A...