16171 matches found
CVE-2020-35582
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the posttitle parameter...
Design/Logic Flaw
This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify function and then written into the HTML page...
Arbitrary Code Injection
json-sanitizer is vulnerable to arbtirary code injection. An attacker could potentially inject arbitrary HTML and XML into embedding documents as closing SCRIPT tags and CDATA section delimiters may be emitted for certain input...
CVE-2021-23899
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents...
CVE-2021-23899
CVE-2021-23899 affects the OWASP json-sanitizer library prior to version 1.2.2. The vulnerability arises when the sanitizer emits closing SCRIPT tags and CDATA section delimiters for crafted input, enabling injection of arbitrary HTML or XML into embedding documents. Affected component: json-sani...
CVE-2021-23899
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents...
Owasp Json-sanitizer Code Issue Vulnerability
Owasp Json-sanitizer is a Java-based code library from the Owasp Foundation that generates Json format data from Json-like text content. A code issue vulnerability exists in OWASP json-sanitizer version 1.2.2, which stems from the possibility that the program may emit closed script tags and CDATA...
Slack: Denial of Service via Hyperlinks in Posts
Summary Via html injection its possible to override all document functions, causing the application to crash because its using the element as a function. Brief explanation of how its possible override document functions with html injection: In some html elements, the name attribute becomes a...
CVE-2020-16030
Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...
SolarWinds Web Help Desk HTML Injection Vulnerability
SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. An HTML injection vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct an HTML injection attack via a Comment in a Help Request work order...
Zoho ManageEngine Desktop Central HTML Injection Vulnerability
Zoho ManageEngine Desktop Central is integrated desktop and mobile device management software that helps manage servers, laptops, desktops, smartphones and tablets from a central location. An HTML injection vulnerability exists in Zoho ManageEngine Desktop Central 10.0.430. The vulnerability can ...
CVE-2019-16954
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...
CVE-2019-16962
Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report...
CVE-2019-16954
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...
Design/Logic Flaw
Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report...
Design/Logic Flaw
SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...
CVE-2019-16962
The provided connected documents describe a concrete vulnerability in Zoho ManageEngine Desktop Central 10.0.430: HTML injection via a modified Report Name in a New Custom Report. The issue is documented across sources (NVD, Red Hat, CNVD, CVE lists) and is confirmed as an HTML injection vulnerab...
CVE-2019-16962
Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report...
CVE-2019-16954
CVE-2019-16954 affects SolarWinds Web Help Desk 12.7.0 with an HTML injection vulnerability via the Comment in a Help Request ticket. The provided connected documents indicate the flaw is caused by accepting user input in a Comment and injecting it into HTML, but do not provide explicit exploit s...