7004 matches found
Incomplete Filtering of Special Elements
Overview Affected versions of this package are vulnerable to Incomplete Filtering of Special Elements. The srcset attribute in an HTML element can be a vector for content spoofing. An attacker can manipulate the content presented to other users by interpolating a srcset value directly that doesn'...
CVE-2024-8373
Improper sanitization of the value of the srcset attribute in HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/ContentSpoofing . This issue affects all versions of...
CVE-2024-8373
CVE-2024-8373 affects AngularJS across distributions; root cause is improper sanitization of the srcset attribute in HTML elements, enabling potential Content Spoofing. Affected versions are older AngularJS; Debian LTS advisory (DLA-4242) fixes angular.js to 1.8.3-1+deb12u1~deb11u1, and related ...
CVE-2024-8373 AngularJS improper sanitization in '<source>' element
Improper sanitization of the value of the srcset attribute in HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/ContentSpoofing . This issue affects all versions of...
CVE-2024-8373
Improper sanitization of the value of the srcset attribute in HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/ContentSpoofing . This issue affects all versions of...
Vulnerability of QTS and QuTS operating systems, as well as Qnap network devices, arises from the lack of measures taken to neutralize special elements used in the operating system commands. This allows attackers to execute arbitrary commands.
The vulnerability of QTS and QuTS operating systems, as well as Qnap network devices, is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
gnark's Groth16 commitment extension unsound for more than one commitment
Description The summary is that the proof of knowledge associated to a commitment is crucial to bind the commitment to the actual circuit variables that were supposed to be committed. However, the same σ is used for all proofs of knowledge for the commitments, which allows mixing between them,...
GHSA-Q3HW-3GM4-W5CR gnark's Groth16 commitment extension unsound for more than one commitment
Description The summary is that the proof of knowledge associated to a commitment is crucial to bind the commitment to the actual circuit variables that were supposed to be committed. However, the same σ is used for all proofs of knowledge for the commitments, which allows mixing between them,...
Uncovering Hybrid Cloud Attacks Part 3 – The Response
In the final section of this blog series on uncovering complex hybrid cloud attacks, we’ll share key elements of the response to the real-world sophisticated cloud attack outlined in Part 2...
CVE-2024-7076
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Blind SQL Injection. This issue affects Semtek Sempos: through 31072024...
CVE-2024-44383: Improper Neutralization of Special Elements used in a Command
WAYOS FBM-291W v19.09.11 is vulnerable to Command Execution via mspinfohtm...
The vulnerability of the application management tools and Flatpak environments lies in the improper elimination of special elements at the output stage, which are used by subordinate components. This allows attackers to gain access to confidential data and compromise its integrity.
The vulnerability of the application management tools and Flatpak environments is related to improper elimination of special elements at the output stage, which are used by lower-level components. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromi...
Exploit for Improper Initialization in Linux Linux_Kernel
It is an exploit module/toolkit targeting unspecified products/s...
CVE-2024-8386
The Mozilla Foundation's Security Advisory: If a site had been granted permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack...
DEBIAN-CVE-2024-8386
If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2...
CVE-2024-8386
If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2...
UBUNTU-CVE-2024-8386
If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2...
CVE-2024-8386
If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2...
CVE-2024-8386
If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2...
CVE-2024-8386
CVE-2024-8386 : A spoofing vulnerability where, if a site has permission to open popup windows, Select elements can appear on top of another site. Affected: Firefox versions before 130, Firefox ESR before 128.2, and Thunderbird before 128.2. Impact is described in external advisories; no exploita...