11462 matches found
[SECURITY] Fedora 31 Update: libxml2-2.9.10-3.fc31
This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...
@bloomreach/hippo-theme (2.2.3), @covisint/cui-idm-b2x (>=0.2.1, <=1.3.0) +369 more potentially affected by CVE-2019-14863 via angular (>=1.0.8, <=1.4.14)
angular NPM version =1.0.8, =0.2.1, =0.2.0-dev, =1.2.6, =0.3.2, =1.0.4, =0.1.1, =1.0.4, =1.1.24, =1.0.3, =1.0.12, =1.0.7, =0.0.1, =3.2.10-0, =3.2.10-1 and more Source cves: CVE-2019-14863 Source advisory: OSV:GHSA-R5FX-8R73-V86C...
CVE-2019-19757
An internal product security audit of Lenovo XClarity Administrator LXCA discovered a Document Object Model DOM based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The...
Cross site scripting
An internal product security audit of Lenovo XClarity Administrator LXCA discovered a Document Object Model DOM based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The...
CVE-2019-19757
An internal product security audit of Lenovo XClarity Administrator LXCA discovered a Document Object Model DOM based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The...
CVE-2019-19757
Lenovo XClarity Administrator (LXCA) DOM-based cross-site scripting vulnerability exists in versions prior to 2.6.6. A specially crafted link could cause JavaScript to run in the user’s browser (executed on the user’s system, not LXCA). The advisory’s remediation is to upgrade to LXCA 2.6.6 or la...
CVE-2020-3864
A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin...
UBUNTU-CVE-2020-3864
A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2, tvOS 13.3.1, Safari 13.0.5, iOS 13.3.1 and iPadOS 13.3.1. A DOM object context may not have had a unique security origin...
CVE-2018-12363
A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the node still having a pointer referencing it. This results in a potentially exploitable crash. This vulnerability affec...
CVE-2013-6455
The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page...
Design/Logic Flaw
The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page...
CVE-2013-6455
The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page...
About the security content of Safari 13.0.5
About the security content of Safari 13.0.5 This document describes the security content of Safari 13.0.5. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...
KLA11650 Multiple vulnerabilities in Apple iCloud
Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, perform cross-site scripting attack, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Multiple memory corruption...
Razer: DOM-based XSS on https://zest.co.th/zestlinepay/
The tester discovered a DOM based XSS on a Razer Gold Thailand associated website that could allow stealing of user session cookies. He provided excellent reproduction steps and a video PoC. Razer thanks the tester for his great report and helping us to keep our customers' information secure...
CVE-2020-7239
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent...
CVE-2020-7239
The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent...
CVE-2020-7239
The CVE-2020-7239 entry concerns the WordPress plugin conversation-watson (before 0.8.21). The vulnerability is a DOM-based XSS that is triggered when a chat message containing JavaScript is sent, indicating an input/output filtering weakness in the plugin's handling of client-side data. The Red ...
