Input validation

EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...

CVE-2022-42960

CVE-2022-42960 concerns the EqualWeb Accessibility Widget. The connected sources confirm a DOM XSS vulnerability in the widget due to improper validation of message events within accessibility.js. Affected versions include 2.0.0 through 4.0.1 (exact sub-versions listed in the public records). The...

CVE-2022-42960

EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...

CVE-2022-42960

EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...

dom-home.me Cross Site Scripting vulnerability OBB-3056995

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

[SECURITY] Fedora 37 Update: libxml2-2.10.3-2.fc37

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

New Vulnerability in Popular Widget Shows Risks of Third-Party Code

UPDATE: Snyk has recently addressed 2 additional vulnerabilities we have reported to them, CVE-2022-24441 and CVE-2022-22984, affecting versions of Snyk CLI before XXX, which leads to arbitrary code execution when scanning untrusted Maven or Gradle projects. Similar to CVE-2022-40764 these...

Uber: DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ]

Vulnerability description not provided...

Urlscan.io API Inadvertently Leaked Sensitive Data and URLs

By Deeba Ahmed Urlscan.io is a website scanning and analyzing engine that accepts URL submissions and creates a trove of data such as IPs, domains, DOM information, screenshots, and cookies. This is a post from HackRead.com Read the original post: Urlscan.io API Inadvertently Leaked Sensitive Dat...

CVE-2022-3873

Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...

Cross site scripting

Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...

UBUNTU-CVE-2022-3873

Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...

CVE-2022-3873

CVE-2022-3873 describes a DOM-based Cross-site Scripting (XSS) vulnerability in the Draw.io project (jgraph/drawio) affecting versions prior to 20.5.2. The available connected documents consistently identify the issue as a DOM XSS without detailing vendor-specific product configurations beyond th...

CVE-2022-3873

Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...

CVE-2022-3873 Cross-site Scripting (XSS) - DOM in jgraph/drawio

Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...

CVE-2022-3873 Cross-site Scripting (XSS) - DOM in jgraph/drawio

Cross-site Scripting XSS - DOM in GitHub repository jgraph/drawio prior to 20.5.2...

The platform’s vulnerability related to ensuring security standards for XML Apache Santuario XML Security for Java allows attackers to trigger a service failure.

The vulnerability of the jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java component of the Apache Santuario XML Security for Java platform is related to resource management errors. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Unauthenticated stored XSS via username & name parameters

There is a stored XSS vulnerability due to improper sanitization of usernames. Vulnerable code User.php line 532: php public function isValidLoginstring $login: bool $login = string$login; if strlen$login loginMinLength || !pregmatch$this-validUsername, $login $this-errors =...

jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

CVE-2022-39353 xmldom allows multiple root nodes in a DOM

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or...