CVE-2018-19048

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...

Cross site scripting

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...

CVE-2018-19048

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...

CVE-2018-19048

Simditor up to version 2.3.21 is affected by a DOM XSS (attackable via an onload attribute in a malformed SVG element). The underlying issue is improper handling/sanitization of SVG onload events, enabling injection of arbitrary JavaScript in the user’s browser. Mitigation: upgrade to version 2.3...

CVE-2018-19048

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...

Mozilla: Use-after-free when removing in-use DOM elements

A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 60.6, Firefox ESR 60.6, and Firefox 66...

Shopify: DOM XSS via Shopify.API.remoteRedirect

hi, team, after I read the report 422043, I found another monitor postmessage, and did not correctly verify the origin, leading to dom xss, using the store theme can write js this feature, we can modify a theme for the following Payload, function attack var...

Mozilla: Use-after-free when removing in-use DOM elements

A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 60.6, Firefox ESR 60.6, and Firefox 66...

Cross-site Scripting (XSS)

preact is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as it was possible to inject virtual-dom nodes through JSON injection...

CVE-2019-3490

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server OES allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and...

Design/Logic Flaw

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server OES allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and...

CVE-2019-3490

CVE-2019-3490 describes a DOM-based XSS in the Netstorage component of Open Enterprise Server (OES). A remote attacker could execute JavaScript in a victim’s browser by enticing them to click a crafted link. Affected are OES2015SP1, OES2018, and OES2018SP1; older versions were not tested. The con...

CVE-2019-3490

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server OES allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and...

Denial Of Service (DoS)

Firefox is vulnerable to use-after-free vulnerability. This occurs when manipulating the DOM during the resize event of an image element. This could result in a potentially exploitable crash when the freed elements are accessed if these elements have been freed due to lack of strong references...

Denial Of Service (DoS)

Firefox, Firefox ESR and Thunderbird are vulnerable to denial of service attacks. A remote unauthenticated attacker could exploit the vulnerable ARIA Attribute Handler component to manipulate accessible rich internet applications ARIA attributes within the DOM, causing buffer overflows resulting ...

Denial Of Service (DoS)

Mozilla Thunderbird is vulnerable to use-after-free vulnerability. This occurs when manipulating arrays of Accessible Rich Internet Applications ARIA elements within containers through the DOM resulting in a potentially exploitable crash...

Memory Corruption

Firefox is vulnerable to memory corruption attacks. This occurs during DOM manipulations of accessibility tree through script, the DOM tree can become out sync with the accessibility tree, crashing the application which results in denial of service...

Use After Free

Thunderbird, Firefox ESR, and Firefox are vulnerable to use-after-free vulnerability. Changing styles when manipulating DOM elements may cause the application to crash resulting in denial of service conditions. The affected component is Style Change Handler...

Denial Of Service (DoS)

firefox is vulnerable to use-after-free vulnerability. Manipulating DOM subtrees in the Editor may result in potentially exploitable crash...

Use-After-Free (UAF)

Firefox, Firefox ESR and Thunderbird are vulnerable to use-after-free vulnerability. Errors in the handling of node adoption while manipulating DOM events and removing audio elements could possibly result in a system crash...