CVE-2020-10960

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...

CVE-2020-10960

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...

CVE-2020-10960

CVE-2020-10960 affects MediaWiki prior to 1.34.1, where jquery.makeCollapsible can apply handlers to arbitrary CSS selectors, allowing injection of CSS classes that can alter UI visibility. There is no publicly documented XSS exploit in the provided sources. Multiple connected docs indicate a fix...

@cardgamesplay/klondike (>=0.1.0, <=0.1.1), @devexpress/analytics-core (>=18.2.7, <=19.1.1-alpha-19071-2010) +61 more potentially affected by CVE-2019-14862 via knockout (>=3.0.0, <=3.4.2)

knockout NPM version =3.0.0, =0.1.0, =18.2.7, =4.0.0, =0.1.0-zgx, =0.1.0, =1.0.0, =0.0.1, =0.2.20, =18.2.7, =17.2.2-beta, =18.2.7, =2.0.1-beta, =2.0.4-beta - dotnetify-path-fix 1.0.0-beta and more Source cves: CVE-2019-14862 Source advisory: OSV:GHSA-VCJJ-XF2R-MWVC...

PT-2020-2139 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.34.1 Description: The issue in MediaWiki is related to the lack of proper output encoding or escaping, which can be exploited by a remote attacker to impact data integrity. Users can add various Cascading Style...

Fedora 30 : php (2020-ce5a2a7403)

PHP version 7.3.16 19 Mar 2020 Core: - Fixed bug php63206 restoreerrorhandler does not restore previous errors mask. Mark Plomer DOM: - Fixed bug php77569: Write Access Violation in DomImplementation. Nikita, cmb - Fixed bug php79271 DOMDocumentType::$childNodes is NULL. cmb Enchant: - Fixed bug...

Cross-Site Scripting

Overview Versions of htmr prior to 0.8.7 are vulnerable to Cross-Site Scripting XSS. The package uses innerHTML to unescape HTML entities. This may lead to DOM-based XSS through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser...

CVE-2020-8923

An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript XSS. Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the d...

CVE-2020-8923

An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript XSS. Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the d...

Design/Logic Flaw

An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript XSS. Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the d...

CVE-2020-8923 XSS in Dart

An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0, allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript XSS. Mitigation: update your Dart SDK to 2.7.2, and 2.8.0-dev.17.0 for the d...

CVE-2020-8923

CVE-2020-8923 describes an XSS in Dart via improper HTML sanitization that can be bypassed using DOM Clobbering. Affected: Dart SDK up to 2.7.1 and dev versions 2.8.0-dev.16.0 . Impact: attacker can inject custom HTML/JavaScript when user-provided data populates DOM nodes. Mitigation: upgrade to ...

Fedora 31 : php (2020-0bf228857a)

PHP version 7.3.16 19 Mar 2020 Core: - Fixed bug php63206 restoreerrorhandler does not restore previous errors mask. Mark Plomer DOM: - Fixed bug php77569: Write Access Violation in DomImplementation. Nikita, cmb - Fixed bug php79271 DOMDocumentType::$childNodes is NULL. cmb Enchant: - Fixed bug...

[SECURITY] Fedora 30 Update: seamonkey-2.53.1-2.fc30

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

[SECURITY] Fedora 31 Update: seamonkey-2.53.1-2.fc31

SeaMonkey is an all-in-one Internet application suite. It includes a browser, mail/news client, IRC client, JavaScript debugger, and a tool to inspect the DOM for web pages. It is derived from the application formerly known as Mozilla Application Suite...

dom-prestarelykh.ru Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1109166 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting dom-prestarelykh.ru websit...

CVE-2020-5334

RSA Archer, versions prior to 6.7 P2 6.7.0.2, contains a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM...

Rockstar Games: DOM XSS on https://www.rockstargames.com/GTAOnline/feedback

In this report, the researcher identified a DOM-based Cross-Site Scripting vulnerability in the /GTAOnline/feedback endpoint. As we worked together on resolving this matter, the researcher helped us identify other parts of the GTA Online sub-site that suffered from the same vulnerability due to...

Rockstar Games: Dom based XSS on www.rockstargames.com/GTAOnline/features/freemode

In this report, the researcher identified a DOM-Based XSS vulnerability on www.rockstargames.com/GTAOnline/features/freemode. This type of attack can result in cookie theft, or enable CSRF and phishing attacks. With the researcher's help we were able to identify the cause of the vulnerability and...

CVE-2016-1000004

Insufficient type checks were employed prior to casting input data in SimpleXMLElementexportNode and simplexmlimportdom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 inclusive, and all versions between 3.13.0 and 3.14.1 inclusive...