CVE-2024-5837

Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: High...

VSCode ipynb Remote Development RCE

VSCode when opening an Jupyter notebook .ipynb file bypasses the trust model. On versions v1.4.0 - v1.71.1, its possible for the Jupyter notebook to embed HTML and javascript, which can then open new terminal windows within VSCode. Each of these new windows can then execute arbitrary code at...

VSCode ipynb Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VSCode ipynb Remote Development RCE', 'Description' = %q VSCode when opening an Jupyter notebook .ipynb file bypasses the trust model. On version...

ZendFramework potential Cross-site Scripting vectors due to inconsistent encodings

A number of classes, primarily within the ZendForm, ZendFilter, ZendForm, ZendLog and ZendView components, contained character encoding inconsistencies whereby calls to the htmlspecialchars and htmlentities functions used undefined or hard coded charset parameters. In many of these cases develope...

GHSA-5GMF-3C43-Q73V ZendFramework vulnerable to Cross-site Scripting

Zend\Debug, Zend\Feed\PubSubHubbub, Zend\Log\Formatter\Xml, Zend\Tag\Cloud\Decorator, Zend\Uri, Zend\View\Helper\HeadStyle, Zend\View\Helper\Navigation\Sitemap, and Zend\View\Helper\Placeholder\Container\AbstractStandalone were not using Zend\Escaper when escaping HTML, HTML attributes, and/or...

ZendFramework vulnerable to Cross-site Scripting

Zend\Debug, Zend\Feed\PubSubHubbub, Zend\Log\Formatter\Xml, Zend\Tag\Cloud\Decorator, Zend\Uri, Zend\View\Helper\HeadStyle, Zend\View\Helper\Navigation\Sitemap, and Zend\View\Helper\Placeholder\Container\AbstractStandalone were not using Zend\Escaper when escaping HTML, HTML attributes, and/or...

Cross-site scripting (XSS) vulnerability in Description metadata

Summary Regardless of the role or privileges, no user should be able to inject malicious JavaScript JS scripts into the body HTML. an XSS Cross-Site Scripting vulnerability, specifically a Stored XSS, which affects all pages of the website. Once the JS script is embedded in the body HTML, the XSS...

CVE-2024-36773

A cross-site scripting XSS vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php...

Fedora: Security Advisory (FEDORA-2024-2e27372d4c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-36775

Monstra CMS 3.0.4 is affected by an XSS vulnerability in the Edit Profile page, where crafted payloads placed into the About Me field can execute arbitrary web scripts/HTML. The issue stems from reflecting or injecting content via the About Me parameter, enabling potential code execution in the c...

Reflected Cross Site Scripting (XSS)

dolibarr/dolibarr is vulnerable to a Reflected Cross-site Scripting XSS. The vulnerability is due to improper input validation in htdocs/compta/paiement/card.php, allowing remote attackers to inject arbitrary web script or HTML via the facid parameter...

Cross-site Scripting(XSS)

actiontext is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the lack of sanitization of HTML content within instances of ActionText::Attachable::ContentAttachment included in a richtextarea tag, which results in unsanitized HTML rendering...

Northwind Demo 1.0 Cross Site Scripting

Exploit Title: Northwind, company operations database - Cross-Site Scripting Reflected Date: 04.06.2024 Exploit Author: Furkan Eren Tetik Vendor Homepage: https://bigprof.com/appgini/free-open-source-web-applications Software Link: https://github.com/bigprof-software/northwind-demo Version: 1.0...

Cross-site Scripting (XSS)

typo3/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of user input, allowing authenticated editors to inject arbitrary HTML or JavaScript...

CVE-2024-28103

A flaw was found in rubygem-actionpack. Since version 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML-related Content-Type. This vulnerability is fixed in versions 6.1.7.8, 7.0.8.2, and 7.1.3.3...

[SECURITY] Fedora 40 Update: qt5-qtwebchannel-5.15.14-1.fc40

The Qt WebChannel module provides a library for seamless integration of C++ and QML applications with HTML/JavaScript clients. Any QObject can be published to remote clients, where its public API becomes available...

Muslim Prayer Time BD <= 2.4 - Settings Reset via CSRF

Description The plugin does not have CSRF check in place when reseting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack Make a logged in admin open an HTML file containing:...

ActionText ContentAttachment can Contain Unsanitized HTML

Instances of ActionText::Attachable::ContentAttachment included within a richtextarea tag could potentially contain unsanitized HTML. This has been assigned the CVE identifier CVE-2024-32464. Versions Affected: = 7.1.0 Not affected: 7.1.0 Fixed Versions: 7.1.3.4 Impact ------ This could lead to a...

CVE-2024-32464

Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a richtextarea tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2...

CVE-2024-28103

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3...