jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods

A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...

CVE-2022-39353

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core "DOMParser" and "XMLSerializer" module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the "childNodes" collection of the "Document", without reporting any...

CVE-2022-39353: Improper Input Validation

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or...

XMLDOM input validation error vulnerability

XMLDOM is a JavaScript implementation of the W3C DOM for Node by the individual developer jindw. A security vulnerability exists in XMLDOM, which stems from the fact that xmldom contains multiple top-level elements and adds all root nodes to the "childNodes" collection of "Document" without...

DEBIAN-CVE-2022-3370

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-3370

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

UBUNTU-CVE-2022-3370

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-3370

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

Design/Logic Flaw

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-3370

CVE-2022-3370 is a Chrome/Chromium vulnerability: a use-after-free in Custom Elements leading to potential heap corruption. Affects Chrome/Chromium prior to version 106.0.5249.91. Exploitation would require a crafted HTML page and could lead to high-severity impact across confidentiality, integri...

CVE-2022-3370

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-3370: Use After Free

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-3370

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2022-3370

Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2022-5710 · Npm +2 · Xmldom +2

Name of the Vulnerable Software and Affected Versions: xmldom versions prior to 0.7.7 xmldom versions prior to 0.8.4 xmldom versions prior to 0.9.0-beta.4 Description: The issue is related to the xmldom module, which is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and...

Arr-pm Library Arbitrary Command Execution

The vulnerability of the Arr-pm library for writing/readding RPM packages for the Ruby programming language exists because measures to neutralize special elements used in the operating system command are not taken. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

FortiOS Command Injection

The vulnerability of the FortiOS operating system exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CERT/CC VINCE Software Coordination Mechanism HTML Injection

The vulnerability of the CERT/CC VINCE software coordination mechanism exists due to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code into an email message with HTML content in the subject field...

Use After Free

chromium is vulnerable to use after free. The vulnerability exists in custom elements of the chromium browser which allows a remote attacker to potentially exploit heap corruption via a malicious HTML page...

Chromium: CVE-2022-3370 Use after free in Custom Elements

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...