CVE-2020-15595

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature to configure elements included in the scope of elements managed by the product allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product...

CVE-2020-15595

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature to configure elements included in the scope of elements managed by the product allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product...

Mozilla: XSS when pasting attacker-controlled data into a contenteditable element

The Mozilla Foundation Security Advisory describes this flaw as: Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element...

CVE-2020-15595

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature to configure elements included in the scope of elements managed by the product allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product...

PT-2020-14520 · Zoho · Zoho Application Control Plus

Name of the Vulnerable Software and Affected Versions: Zoho Application Control Plus versions prior to 10.0.511 Description: An issue in the Element Configuration feature of Zoho Application Control Plus allows an attacker to retrieve the list of IP ranges and subnets configured in the product...

CVE-2020-15595: Undefined Security Weakness

An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature to configure elements included in the scope of elements managed by the product allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product...

CVE-2020-15676

Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element. This vulnerability affects Firefox 81, Thunderbird 78.3, and Firefox ESR 78.3...

Mozilla: XSS when pasting attacker-controlled data into a contenteditable element

The Mozilla Foundation Security Advisory describes this flaw as: Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element...

Mozilla: XSS when pasting attacker-controlled data into a contenteditable element

The Mozilla Foundation Security Advisory describes this flaw as: Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element...

Intel Graphics Driver DoS

The vulnerability of the Intel Graphics Driver lies in the lack of commas in the syntax of elements or search paths. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2020-15676

The Mozilla Foundation Security Advisory describes this flaw as: Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contenteditable element...

Spoofing Attack

firefox is vulnerable to spoofing. The vulnerability exists through a logic flaw in the location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element...

CVE-2020-11115: Out-of-bounds Read

u'Buffer over read occurs while processing information element from beacon due to lack of check of data received from beacon' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voi...

GHSA-CHQJ-J4FH-RW7M Cross-Site Scripting in dompurify

Versions of dompurify prior to 2.0.3 are vulnerable to Cross-Site Scripting XSS. The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of / elements and /. An example payload is: ". This allows attackers to bypass the XSS protection and execute...

TeamViewer Remote Access Hash Disclosure

The vulnerability of TeamViewer’s remote control software lies in the lack of commas in the syntax of certain elements or search paths. Exploiting this vulnerability allows a malicious actor to intercept the administrator’s password hash...

(0Day) WECON LeviStudioU Disc WordAddr Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WECON LeviStudioU. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of t...

snd_ctl_elem_add in sound/core/control.c in the Linux kernel through 5.6.3 has a count=info->owner line which later affects a private_size*count multiplication for unspecified "interesting side effects." NOTE: kernel engineers dispute this finding because it could be relevant only if new callers were added that were unfamiliar with the misuse of the info->owner field to represent data unrelated to the "owner" concept. The existing callers SNDRV_CTL_IOCTL_ELEM_ADD and SNDRV_CTL_IOCTL_ELEM_REPLACE have been designed to misuse the info->owner field in a safe way

...

CVE-2016-11085

php/qmnoptionsquestionstab.php in the quiz-master-next plugin before 4.7.9 for WordPress allows CSRF, with resultant stored XSS, via the questionname parameter because js/adminquestion.js mishandles parsing inside of a SCRIPT element...

Cross-Site Scripting

Overview @progress/kendo-angular-editor before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed. Adding the following content to the Editor value demonstrates the issue: . Recommendatio...

PT-2020-21363

Name of the Vulnerable Software and Affected Versions @progress/kendo-angular-editor versions prior to 1.2.3 Description The issue allows for Cross-Site Scripting when the Editor content contains potentially malicious scripts in element event handlers, which get executed. For example, adding the...