10991 matches found
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...
MAL-2022-5673 Malicious code in react-server-dom-vite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38bacfa115db90fd1da93cce7d4c6fd3d152db72097f0aea4c235e7bb27fe64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in react-server-dom-vite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38bacfa115db90fd1da93cce7d4c6fd3d152db72097f0aea4c235e7bb27fe64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.18.1)
The version of AOS installed on the remote host is prior to 5.18.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.18.1 advisory. - An issue was found in Linux kernel before 5.5.4. The mwifiexcmdappendvsietlv function in...
Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19)
The version of AOS installed on the remote host is prior to 5.19. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - eve...
@aqsc/form-making (>=0.0.22, <=0.0.39), @ariesate/are-components (1.0.1) +86 more potentially affected by CVE-2022-25646 via x-data-spreadsheet (>=1.1.4, <=1.1.9)
x-data-spreadsheet NPM version =1.1.4, =0.0.22, =1.1.0, =1.1.5, =0.0.1-alpha.1, =0.0.1, =0.0.1, =0.0.1, =1.0.1, =1.0.4 and more Source cves: CVE-2022-25646 Source advisory: OSV:GHSA-X5CW-843F-R366...
Ubuntu: Security Advisory (USN-322-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu: Security Advisory (USN-124-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Code injection
The Auto-hyperlink URLs WordPress plugin through 5.4.1 does not set rel="noopener noreferer" on generated links, which can lead to Tab Nabbing by giving the target site access to the source tab through the window.opener DOM object...
CVE-2022-2600
The CVE-2022-2600 entry concerns the WordPress plugin Auto-hyperlink URLs (versions through 5.4.1). The underlying issue is that generated links do not include rel="noopener noreferer", enabling Tab Nabbing and potentially exposing the source tab via window.opener. The vulnerability impact, as do...
CVE-2022-0542
Cross-site Scripting XSS - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0...
Cross site scripting
Cross-site Scripting XSS - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0...
CVE-2022-0542
CVE-2022-0542 is a DOM-based XSS in chatwoot/chatwoot prior to version 2.7.0. Attackers can inject malicious script via user-controlled content (e.g., markdown/links) that is rendered in the DOM, enabling arbitrary JS execution. Public sources confirm the issue affects chatwoot/chatwoot before 2....
Malicious Package
Overview react-dom17 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
openSUSE 15 Security Update : seamonkey (openSUSE-SU-2022:10089-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:10089-1 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...
Hyperledger: Cross Site Scripting Vulnerability in fabric-sdk-py source code
See this fix on GitHub https://github.com/hyperledger/fabric-sdk-py/pull/175 Impact Some old affected versions of this package are vulnerable to Cross-site Scripting XSS. Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html,...
CVE-2022-36325
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...
Cross site scripting
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...
CVE-2022-36325
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...