Server side request forgery (ssrf)

All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as...

CVE-2021-23345 Server-side Request Forgery (SSRF)

All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when the src attribute of an HTML element refers to an internal system file, such as...

Rockwell Automation DriveTools SP and Drives AOP

1. EXECUTIVE SUMMARY CVSS v3 7.5 Vendor : Rockwell Automation Equipment : DriveTools SP and Drives AOP Vulnerability : Uncontrolled Search Path Element 2. RISK EVALUATION Successful exploitation of this vulnerability may result in privilege escalation and total loss of device confidentiality,...

Adobe Dreamweaver 代码问题漏洞

Adobe Dreamweaver is the United States of America Odooby Adobe company a Windows-based platform to support visual HTML editing and code editing software. An uncontrolled search path element vulnerability exists in Adobe Dreamweaver. An attacker could exploit this vulnerability to cause an...

The vulnerability of the Adobe Animate program for creating multimedia and computer animations lies in its uncontrolled search element, which allows a hacker to execute arbitrary code.

The vulnerability of the Adobe Animate software for creating multimedia and computer animations is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the current user, using a specially craft...

The vulnerability of the program for creating interactive E-learning courses using ready-made slides from Adobe Captivate 2019 lies in its uncontrolled search element, which allows a malicious user to escalate their privileges.

The vulnerability of the program for creating interactive E-learning courses using ready-made slides from Adobe Captivate 2019 is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow a malicious actor to gain more privileges in the context of the curre...

Design/Logic Flaw

Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts...

RUSTSEC-2021-0018 insert_slice_clone can double drop if Clone panics.

Affected versions of this crate used ptr::copy when inserting into the middle of a Vec. When ownership was temporarily duplicated during this copy, it calls the clone method of a user provided element. This issue can result in an element being double-freed if the clone call panics. Commit 20cb73d...

Qualcomm Wlan Firmware Security Vulnerability

Qualcomm Wlan Firmware is a Wlan support firmware from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Wlan Firmware, which is a denial of service in FTMR due to a mishandled error that sets a reserved bit in the FTM parameter IE...

Qualcomm Wlan Firmware Buffer Error Vulnerability

Qualcomm Wlan Firmware is a Wlan support firmware from Qualcomm Incorporated USA. The Qualcomm Wlan Firmware suffers from a buffer error vulnerability that stems from improper validation of P2P IE and NOA attribute lengths, which could result in a buffer overflow...

CVE-2020-28487

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application...

CVE-2020-28487 Cross-site Scripting (XSS)

This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application...

The vulnerability in the implementation of the Referrer Policy policy of the Mozilla Firefox browser allows a violator to gain unauthorized access to protected information.

The vulnerability of the Referrer Policy implementation in Mozilla Firefox’s browser is related to an incorrect request for the element, which can be triggered multiple times. Exploiting this vulnerability may allow a remote attacker to gain unauthorized access to protected information...

CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

Design/Logic Flaw

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

CVE-2021-25325

MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs...

CVE-2021-25325

CVE-2021-25325 affects MISP 2.4.136. It enables cross-site scripting via galaxy cluster element values sent to app/View/GalaxyElements/ajax/index.ctp, where reference types may include javascript: URLs. The issue arises from unsanitized input in galaxy elements, enabling an attacker to execute sc...

Adobe InCopy Uncontrolled Search Path Element Vulnerability

Adobe InCopy is a professional word processing program from Adobe that is integrated with Adobe InDesign. An uncontrolled search path element vulnerability exists in Adobe InCopy 15.1.3 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary code...

Adobe Illustrator 代码问题漏洞

Adobe Illustrator 2020 is a vector graphics editor. An uncontrolled search path element vulnerability exists in Adobe Illustrator 2020 25.0 and earlier versions. An attacker can exploit the vulnerability to execute arbitrary code...

Element OS Remote Code Execution Vulnerability

Element OS is a set of Linux operating systems for home theater PC computers. A security vulnerability exists in Element OS versions prior to 1.8P1 and 12.2, which arises from a failure of a networked system or product to properly filter specific elements of externally-entered data during the...