GHSA-FWX5-5FQJ-JV98 Cross-Site Scripting in morris.js

Affected versions of morris.js are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run o...

CVE-2018-14850

Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image...

CVE-2017-16022

Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded...

ZhaiduMap SQL Injection Vulnerability (CNVD-2018-02954)

Joomla! is the U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other functions. Zh BaiduMap is used in one of the Baidu map component . A SQL injection vulnerability exists in version 3.0.0.1 of Joomla! A...

PowerPoint Malicious Hover Exploit

There exists a malicious downloader vulnerability in Microsoft Office PowerPoint. This is because of the way PowerPoint presentation format handles link hover. A successful attack could lead to malicious files being downloaded...

chromatopy (>=1.8.0, <=1.9.0), crf-tagger (0.1.0) +1 more potentially affected by CVE-2016-10075 via tqdm (2.2.4)

tqdm PYPI version 2.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on tqdm and may be impacted: - chromatopy =1.8.0, =0.0.7, =0.0.10 Source cves: CVE-2016-10075 Source advisory: OSV:PYSEC-2017-74...

Mozilla: Use-after-free in synthetic mouse movement (MFSA 2013-114)

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via...

CVE-2013-5613

Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via...

XSS Vulnerability in AAC - Atlassian ID Display Name is not HTML-encoded on user hover

Raised from https://extranet.atlassian.com/jira/browse/INTSYS-23426...

XSS Vulnerability in AAC - Atlassian ID Display Name is not HTML-encoded on user hover

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Cloud. Using Confluence Server? See the corresponding bug report|http://jira.atlassian.com/browse/CONFSERVER-46719. panel Raised from https://extranet.atlassian.com/jira/browse/INTSYS-23426...

XSS Vulnerability in AAC - Atlassian ID Display Name is not HTML-encoded on user hover

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-46719. panel Raised from https://extranet.atlassian.com/jira/browse/INTSYS-23426...

Fedora 15 : thunderbird-13.0-1.fc15 / thunderbird-lightning-1.5-2.fc15 (2012-9079)

What is new : - Filelink: Upload your files to an online storage service and send links to your friends, avoiding bounce back due to large attachments. We have partnered with YouSendIt to bring this feature, but additional partners will be added in the near future. - In partnership with Gandi and...

CVE-2011-2635

The Cascading Style Sheets CSS implementation in Opera before 11.10 allows remote attackers to cause a denial of service application crash via vectors involving use of the :hover pseudo-class, in conjunction with transforms, for a floated element...

PT-2011-3984

Name of the Vulnerable Software and Affected Versions Opera versions prior to 11.10 Description The issue concerns the Cascading Style Sheets CSS implementation, which allows remote attackers to cause a denial of service, resulting in an application crash. This can be achieved through specific...

Mozilla Firefox 3.6.7 插件参数引用悬停指针漏洞

BUGTRAQ ID: 41933 CVE ID: CVE-2010-2755 Firefox是一款非常流行的开源WEB浏览器。 Firefox的插件处理器中存在无效释放漏洞，在某些情况下可能过早的释放插件例程参数数组中的属性，留下插件可执行的悬停指针，可能会调用攻击者所控制的内存。 用户受骗访问恶意的web内容可能导致释放无效的内存指针，Firefox可能会崩溃或以运行Firefox用户的权限执行任意代码。 Mozilla Firefox 3.6.7 厂商补丁： Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

CVE-2010-1412

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to hover events...

CVE-2010-1412

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to hover events...

Design/Logic Flaw

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to hover events...

CVE-2010-1412

CVE-2010-1412 affects WebKit in Safari (pre-5.0 on Mac OS X 10.5–10.6 and Windows; pre-4.1 on Mac OS X 10.4). The issue is a use-after-free in hover-event handling that can allow remote code execution or cause an application crash (DoS). The description and related Nessus/OpenVAS entries confirm ...

EUVD-2010-1440

Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service application crash via vectors related to hover events...