CVE-2020-11737: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring including the quotes followed...

CVE-2019-1010113

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting XSS. The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a lin...

PT-2019-11471

Name of the Vulnerable Software and Affected Versions: Premium Software CLEditor versions 1.4.5 and earlier Description: The issue allows an attacker to inject arbitrary HTML and script code into a website, potentially leading to Cross Site Scripting XSS. This is made possible when the victim ope...

CVE-2019-1010113: Improper Neutralization of Input During Web Page Generation

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting XSS. The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a lin...

CVE-2019-12173

MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...

Remote code execution

MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...

CVE-2019-12172

Typora 0.9.9.21.1 1913 allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137...

Code injection

Typora 0.9.9.21.1 1913 allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137...

CVE-2019-12173: Improper Limitation of a Pathname to a Restricted Directory

MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...

PT-2019-12679

Name of the Vulnerable Software and Affected Versions MacDown version 0.7.1 Description The issue allows remote code execution via a file: URI with a .app pathname in the HREF attribute of an A element. Recommendations For MacDown version 0.7.1, update to a newer version that contains a fix for...

CVE-2019-12172: Improper Limitation of a Pathname to a Restricted Directory

Typora 0.9.9.21.1 1913 allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137...

PT-2019-12678

Name of the Vulnerable Software and Affected Versions Typora version 0.9.9.21.1 Description The issue allows for arbitrary code execution through a modified file: URL syntax in the HREF attribute of an AREA element. This can be achieved using specific file paths, such as file: on macOS or Linux, ...

Cross-site Scripting (XSS)

struts2-core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the improper handling of double quote characters in the href attribute of the s:a tag, as well as the parameters in the action attribute of the s:url tag, allowing XSS attacks...

Cross site scripting

Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...

CVE-2018-11093

Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...

CVE-2018-11093

Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...

CVE-2018-11093

Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...

CVE-2018-11093

Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...

PT-2018-10304

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions prior to 10.0.1 status-board versions prior to 10.0.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script through a crafted href attribute of a link element. The createPreviewButt...

CVE-2018-11093: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...