CVE-2019-19328

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

XML External Entities (XXE)

nifi-lookup-services is vulnerable to XML external entities XXE. The vulnerability exists as the XMLFileLookupService allowed trusted users to use a malicious XML file to cause information such as the versions of Java, Jersey, and Apache to be revealed...

XML External Entities (XXE)

jackson-mapper-asl is vulnerable to XML external entity attacks. This vulnerability is similar to CVE-2016-3720 whereby the external DTD is not disabled, allowing an attacker to retrieve system files, or perform requests on behalf of the server using malicious XML documents...

Design/Logic Flaw

Sandline Centraleyezer On Premises allows Stored XSS using HTML entities in the name field of the Category section...

CVE-2019-12299

Sandline Centraleyezer On Premises allows Stored XSS using HTML entities in the name field of the Category section...

CVE-2019-12299

The connected records confirm a Stored XSS vulnerability in Sandline Centraleyezer (On Premises) affecting the Category section’s name field. Root cause: lack of proper validation of client-side data (HTML entities). Impact: client-side code execution. No version-specific affected components or p...

Threat Analysis Unit (TAU) Threat Intelligence Notification: OSX.Yort

In March of 2019 Kaspersky published an article about the Lazarus APT group continued targeting of financial entities. Their report noted that this new campaign being tracked was targeting both Windows and macOS users. The campaign used both malicious PowerShell scripts on windows as well as macO...

Safe SVG < 1.9.6 - XSS Protection Bypass

By using entities in payload XSS will success to bypass the protection of the Safe SVG Plugin PoC Video POC for Video PoC for v1.9.5 : https://www.youtube.com/watch?v=hnQA2hc-4k...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

Parallels Plesk Panel 9.5 Cross Site Scripting

Exploit Title: Parallels Plesk Panel 9.5 Reflected XSS Release Date: 06/11/2019 Author: Cyber Citadel Website: www.cybercitadel.com Vendor: www.plesk.com Versions 9.5 Description A Cross Site Scripting vulnerability occurs when an attacker can inject JavaScript in context of the web application...

Code injection

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits...

CVE-2013-6461

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits...

CVE-2013-6461

Nokogiri gem versions 1.5.x and 1.6.x are affected by a DoS vulnerability when parsing XML entities due to failing to apply limits. The issue is described across multiple connected sources (SUSE, Ubuntu, Debian security trackers, RubyGems advisories, and NVD). The CVE entry itself lists DoS as th...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

Mozilla Thunderbird Security Advisories (MFSA2019-32, MFSA2019-35) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Mozilla: Incorrect HTML parsing results in XSS bypass technique

A flaw was found in Mozilla Firefox and Thunderbird where null bytes were incorrectly parsed in HTML entities. This could lead to HTML comments being treated as code which could lead to XSS in a web application or HTML entities being masked from filters...

Cross-Site Scripting (XSS)

firefox is vulnerable to cross-site scripting XSS. Failure to correctly handle null bytes when processing HTML entities results in incorrectly parsing of these entities, leading to HTML comment text being treated as HTML which could result in an XSS in a web application under certain conditions...

Unspecified Vulnerability in Mozilla Firefox and Mozilla Firefox ESR (CNVD-2019-38480)

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security vulnerability exists in Mozilla Firefox versions prior to 70 and...