742 matches found
CVE-2019-12173: Improper Limitation of a Pathname to a Restricted Directory
MacDown 0.7.1 870 allows remote code execution via a file:\\ URI, with a .app pathname, in the HREF attribute of an A element. This is different from CVE-2019-12138...
CVE-2019-12172: Improper Limitation of a Pathname to a Restricted Directory
Typora 0.9.9.21.1 1913 allows arbitrary code execution via a modified file: URL syntax in the HREF attribute of an AREA element, as demonstrated by file:\\ on macOS or Linux, or file://C| on Windows. This is different from CVE-2019-12137...
Atlassian Fisheye and Crucible Cross-Site Scripting Vulnerabilities (CNVD-2019-04923)
Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in the administrative linker feature in Atlassian Fisheye...
CVE-2018-20240: Improper Neutralization of Input During Web Page Generation
The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the href parameter...
Stored XSS in administrative linker functionality through the href parameter - CVE-2018-20240
The administrative linker functionality in Atlassian Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the href parameter...
Cross-site Scripting (XSS)
struts2-core is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the improper handling of double quote characters in the href attribute of the s:a tag, as well as the parameters in the action attribute of the s:url tag, allowing XSS attacks...
UBUNTU-CVE-2018-14952
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "maction xlink:href=" attack...
CVE-2018-14952
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "maction xlink:href=" attack...
CVE-2018-14953
The mail message display page in SquirrelMail through 1.4.22 has XSS via a "math xlink:href=" attack...
Cross-site Scripting (XSS)
primefaces is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization on the href value when rendered through printer.js, allowing XSS attacks to occur...
Cross-Site Scripting in @ckeditor/ckeditor5-link
Versions of status-board prior to 10.0.1 are vulnerable to Cross-Site Scripting. The createPreviewButton function fails to sanitize the href attribute of a created tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser. Recommendation Upgrade to version 10.0.1 or late...
Cross site scripting
Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...
CVE-2018-11093
Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...
CVE-2018-11093
Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...
CVE-2018-11093
Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...
CVE-2018-11093: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Link package for CKEditor 5 before 10.0.1 allows remote attackers to inject arbitrary web script through a crafted href attribute of a link A element...
Cross-Site Scripting
Overview All versions of react-marked-markdown are vulnerable to cross-site scripting XSS via href attributes. This is exploitable if user is provided to react-marked-markdown Proof of concept: import React from 'react' import ReactDOM from 'react-dom' import MarkdownPreview from...
Node.js third-party modules: The react-marked-markdown module allows XSS injection in href values.
NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! I would like to report XSS in...
Microsoft Internet Explorer 11.371.16299.0 (Windows 10) - Denial Of Service
Microsoft Internet Explorer 11.371.16299.0 Windows 10 - Denial Of Service ''' + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-INTERNET-EXPLORER-Win-10-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: =======...
Ruby on Rails: XSS vulnerability in sanitize-method when parsing link's href
Possible XSS vulnerability in rails-html-sanitizer There is a possible XSS vulnerability in rails-html-sanitizer. This vulnerability has been assigned the CVE identifier CVE-2018-3741. Versions Affected: 1.0.3 or older. Not affected: None. Fixed Versions: 1.0.4 Impact ------ There is a possible X...