Cross-Site Scripting (XSS)

Invenio is vulnerable to cross-site scripting XSS attacks. It is exploitable because the main flash messages are displayed as HTML by default...

w3m denial of service vulnerability (CNVD-2016-13129)

w3m is an open source text-based Web browser . A denial of service vulnerability exists in w3m. A remote attacker could cause a denial of service via a crafted HTML page...

CVE-2016-9425

CVE-2016-9425 concerns the w3m fork by Tatsuya Kinoshita prior to 0.5.3-31. it describes a heap-based buffer overflow in addMultirowsForm that can be triggered by a crafted HTML page, enabling a remote attacker to crash the process and potentially execute arbitrary code. The vulnerability is conf...

CVE-2016-9424

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service heap buffer overflow crash and possibly execute arbitrary code via a crafted HTML page...

Brave Software: DOS in browser using window.print() function

Open the attached html poc in browser print window will appear again and again causing dos...

PT-2023-26336 · W3M +3 · W3M +3

Name of the Vulnerable Software and Affected Versions: w3m affected versions not specified Description: An out-of-bounds read flaw was found in the Strnew size function in Str.c, which may allow an attacker to cause a denial of service through a crafted HTML file. Recommendations: At the moment,...

CVE-2015-5375

Cross-site scripting XSS vulnerability in unspecified dialogs for printing content in the Front End in Open-Xchange Server 6 and OX App Suite before 6.22.8-rev8, 6.22.9 before 6.22.9-rev15m, 7.x before 7.6.1-rev25, and 7.6.2 before 7.6.2-rev20 allows remote attackers to inject arbitrary web scrip...

Mandriva Linux Security Advisory : python-lxml (MDVSA-2015:112)

Updated python-lxml packages fix security vulnerability : The cleanhtml function, provided by the lxml.html.clean module, did not properly clean HTML input if it included non-printed characters \x01-\x08. A remote attacker could use this flaw to serve malicious content to an application using the...

Microsoft windows Adobe Font Driver Denial of Service Vulnerability

Microsoft Windows is an operating system developed by Microsoft. Microsoft Windows Adobe Font Driver fails to properly handle specially crafted files or HTML, allowing attackers to exploit the vulnerability to trigger memory allocation errors and conduct denial of service attacks...

Microsoft windows Adobe font driver buffer overflow vulnerability (CNVD-2015-01624)

Microsoft Windows is an operating system developed by Microsoft. A security vulnerability exists in Microsoft Windows Adobe due to a failure of the font driver to properly handle specially crafted files or HTML, which allows attackers to exploit the vulnerability for buffer overflow attacks that...

Microsoft windows Adobe Font Driver Buffer Overflow Vulnerability

Microsoft Windows is an operating system developed by Microsoft. Microsoft Windows Adobe Font Driver does not properly handle specially crafted files or HTML, allowing attackers to exploit the vulnerability for buffer overflow attacks that can crash applications or execute arbitrary code...

CVE-2014-100037

Cross-site scripting XSS vulnerability in Storytlr 1.3.dev and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to archives/...

CVE-2014-0571

Cross-site scripting XSS vulnerability in Adobe ColdFusion 9.0 before Update 13, 9.0.1 before Update 12, 9.0.2 before Update 7, 10 before Update 14, and 11 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3033

Cross-site scripting XSS vulnerability in IBM Emptoris Sourcing Portfolio 9.5.x before 9.5.1.3, 10.0.0.x before 10.0.0.1, 10.0.1.x before 10.0.1.3, and 10.0.2.x before 10.0.2.4 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

David Harris Pegasus Mail 3.12 File Forwarding Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1738/info It is possible for a malicious website operator to obtain copies of known files on a remote system if a website visitor is running Pegasus Mail client. If the following code were to be inserted into a HTML...

CVE-2014-2711

Cross-site scripting XSS vulnerability in J-Web in Juniper Junos before 11.4R11, 11.4X27 before 11.4X27.62 BBE, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D35, 12.1X45 before 12.1X45-D25, 12.1X46 before 12.1X46-D20, 12.2 before 12.2R7, 12.3 before 12.3R6, 13.1 before 13.1R4, 13.2 before 13.2R3, a...

CVE-2014-2244

Cross-site scripting XSS vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in t...

CVE-2013-3523

SQL injection vulnerability in This HTML Is Simple THIS before 1.2.4 allows remote to execute arbitrary SQL commands via vectors related to op=page&id= in the URL...

Cross site scripting

Cross-site scripting XSS vulnerability in inc/extensions.php in VertrigoServ 2.25 allows remote attackers to inject arbitrary web script or HTML via the ext parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in e107 0.7.22 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...