6350 matches found
CVE-2020-8572
NetApp Element OS prior to version 12.0 and Element HealthTools prior to 2020.04.01.04 are affected by CVE-2020-8572, which could allow an attacker to disclose sensitive information. The vulnerability is described consistently across multiple sources in the provided documents (NetApp advisory and...
CVE-2020-8572
Element OS prior to version 12.0 and Element HealthTools prior to version 2020.04.01.04 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information...
Cross-site Scripting (XSS)
Overview angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this package...
CVE-2020-12394
The Mozilla Foundation Security Advisory describes this flaw as: A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element...
The vulnerability of the SVGStartElement function in the GraphicsMagick graphics editor involves an operation that goes beyond the buffer boundaries in memory. This allows attackers to gain unauthorized access to information and compromise its integrity and accessibility.
The vulnerability of the SVGStartElement function in the GraphicsMagick graphics editor is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to information and compromise its integrity and...
CVE-2020-12391
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...
CVE-2020-12394
A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. This vulnerability affects Firefox 76...
UBUNTU-CVE-2020-12391
Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox 76...
Webform - Critical - Access bypass - SA-CONTRIB-2020-016
This webform module enables you to build 'Term select' and 'Term checkboxes' elements. The module doesn't sufficiently check term 'view' access when rendering the 'Term select' and 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term select' and 'Term checkboxes' elements...
CVE-2019-9498
A flaw was found in wpasupplicant. An attack using invalid scalar/element values is possible against the EAP-pwd server since hostapd and wpasupplicant did not validate these values in the received EAP-pwd-Commit messages. When processing an EAP-pwd Commit frame, the peer's scalar and element...
CVE-2020-11023
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods i.e. .html, .append, and others may execute untrusted code. This problem is patched in jQuery 3.5.0...
Adobe Bridge EPS BoundingBox Element Stack-based Buffer Overflow Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of the...
The vulnerability of the Rust programming language plugin rustdoc, which allows a hacker to execute arbitrary code
The vulnerability of the Rust programming language plugin rustdoc is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
XSS in python-markdown2
python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute...
Node.js third-party modules: [flsaba] Stored XSS in the file and directory name when directories listing
I would like to report a Stored XSS in module "flsaba". It allows to inject malicious scripts in the file and directory name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: https://www.npmjs.com/package/flsaba version: 1.1.0 npm...
CVE-2018-18405
jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...
CVE-2018-18405
jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...
CVE-2018-18405
Removed by vendor...
PT-2020-8631 · Jquery · Jquery
Name of the Vulnerable Software and Affected Versions: jQuery version 2.2.2 Description: The issue allows for cross-site scripting XSS attacks via a crafted onerror attribute of an IMG element. Recommendations: For jQuery version 2.2.2, consider disabling the use of the onerror attribute in IMG...