Fedora 22 : php-htmLawed-1.1.20-1.fc22 (2015-10139)

1.1.20 - 9 June 2015. Fix for a potential security vulnerability arising from unescaped double-quote character in single-quoted attribute value of some deprecated elements when tag transformation is enabled; recognition for non-HTML4 standard 'allowfullscreen' attribute of 'iframe.' Note that...

Vanilla Forums 2.1.1 Cross Site Scripting

The vulnerability is related to the insufficient filtration in HTMLawed. Existing filter can be bypassed and paste into the HTML tag onerror event, that leads to stored XSS. I notified the developers of existing vulnerabilities and they closed it in version 2.1.1 proof:...

CVE-2010-4646

Cross-site scripting XSS vulnerability in Hastymail2 before 1.01 allows remote attackers to inject arbitrary web script or HTML via a crafted background attribute within a cell in a TABLE element, related to improper use of the htmLawed filter...

PT-2011-1614

Name of the Vulnerable Software and Affected Versions Hastymail2 versions prior to 1.01 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted background attribute within a cell in a TABLE element. This is related to the improper...

CVE-2010-4646: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Hastymail2 before 1.01 allows remote attackers to inject arbitrary web script or HTML via a crafted background attribute within a cell in a TABLE element, related to improper use of the htmLawed filter...

CVE-2010-4364

DaDaBIK 4.3 beta3, when running in a case-sensitive environment, does not include the htmLawed library, which allows remote attackers to bypass the protection mechanism for CVE-2010-4355 and conduct cross-site scripting XSS attacks via the 1 html content and 2 richeditor fields. NOTE: some of the...

Cross site scripting

DaDaBIK 4.3 beta3, when running in a case-sensitive environment, does not include the htmLawed library, which allows remote attackers to bypass the protection mechanism for CVE-2010-4355 and conduct cross-site scripting XSS attacks via the 1 html content and 2 richeditor fields. NOTE: some of the...

CVE-2010-4364

DaDaBIK 4.3 beta3, when running in a case-sensitive environment, does not include the htmLawed library, which allows remote attackers to bypass the protection mechanism for CVE-2010-4355 and conduct cross-site scripting XSS attacks via the 1 html content and 2 richeditor fields. NOTE: some of the...

CVE-2010-4364

DaDaBIK 4.3 beta3 is affected when run in a case-sensitive environment where the htmLawed library is not included. This root cause (missing htmLawed) enables cross-site scripting (XSS) by manipulating (1) HTML content and (2) rich_editor fields, and it can bypass the protection mechanism tied to ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets CSS expressions in the style attribute, which is processed by Internet Explorer 7...

CVE-2009-0404

Multiple cross-site scripting XSS vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets CSS expressions in the style attribute, which is processed by Internet Explorer 7...

CVE-2009-0404

CVE-2009-0404 affects Bioinformatics htmLawed 1.1.3 and 1.1.4, with multiple XSS vulnerabilities allowing remote injection of arbitrary script/HTML via invalid CSS expressions in the style attribute processed by Internet Explorer 7. The vulnerability details specify the affected component and ent...

CVE-2009-0404

Multiple cross-site scripting XSS vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets CSS expressions in the style attribute, which is processed by Internet Explorer 7...

CVE-2009-0404: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Bioinformatics htmLawed 1.1.3 and 1.1.4 allow remote attackers to inject arbitrary web script or HTML via invalid Cascading Style Sheets CSS expressions in the style attribute, which is processed by Internet Explorer 7...