6287 matches found
CVE-2021-34435
In Eclipse Theia, versions 0.3.9 through 1.8.1 are affected by a vulnerability in the built-in mini-browser extension that previews HTML files in an iframe inside the IDE. The issue arises from how the preview rendering is implemented, enabling a maliciously crafted HTML file viewed in the iframe...
PT-2021-20529 · Eclipse · Eclipse Theia
Name of the Vulnerable Software and Affected Versions: Eclipse Theia versions 0.3.9 through 1.8.1 Description: The issue allows a previewed HTML file to trigger a remote code execution RCE in the Eclipse Theia IDE, specifically through the "mini-browser" extension. This exploit occurs when a user...
CVE-2021-34435: Permissive Cross-domain Policy with Untrusted Domains
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file...
HedgeDoc Cross-Site Scripting Vulnerability (CNVD-2021-93909)
HedgeDoc is a platform for writing and sharing Markdown. cross-site scripting vulnerabilities exist in versions of HedgeDoc prior to 1.9.0. An attacker could exploit the vulnerability by embedding an iframe hosting malicious code into a slideshow or embedding a HedgeDoc instance into another page...
Code injection
HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into...
CVE-2021-39175
HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into...
CVE-2021-39175 XSS vector in slide mode speaker-view
HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into...
CVE-2021-39175: Improper Neutralization of Special Elements in Output Used by a Downstream Component
HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into...
Hedgedoc 跨站脚本漏洞
HedgeDoc is a platform for writing and sharing Markdown. cross-site scripting vulnerabilities exist in versions of HedgeDoc prior to 1.9.0. An attacker could exploit the vulnerability by embedding an iframe hosting malicious code into a slideshow or embedding a HedgeDoc instance into another page...
Cross-site Scripting (XSS) - Reflected in azuracast/azuracast
✍️ Description The Application is Vulnerable to reflected HTML Injection 🕵️♂️ Proof of Concept Open the following page in the browser as admin. The page is vulnerable to HTML Injection...
in zoujingli/thinkadmin
✍️ Description It can be possible to perform a clickjacking attack due to the lack of frame restrictions. The application does not set the response header X-Frame-Options: DENY. 🕵️♂️ Proof of Concept 💥 Impact According to PortSwigger references, it is possible for a page controlled by an attacker...
in erikdubbelboer/phpredisadmin
✍️ Description It can be possible to perform a clickjacking attack due to the lack of frame restrictions. The application does not set the response header X-Frame-Options: DENY. 🕵️♂️ Proof of Concept 💥 Impact According to PortSwigger references, it is possible for a page controlled by an attacker...
Cross-site Scripting (XSS) - Reflected in erikdubbelboer/phpredisadmin
✍️ Description The application is vulnerable to XFS attack. 🕵️♂️ Proof of Concept Navigate to https://domain.tld/phpRedisAdmin/?https://www.eia.gov/state/maps The page https://www.eia.gov/state/maps.php will be loaded in an iframe on the page. 💥 Impact Cross-Frame Scripting XFS is an attack that...
archive.org IFRAME Injection vulnerability OBB-2119045
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| archive.org ---|--- Open Bug Bounty...
CVE-2021-39250
Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widget...
CVE-2021-39250
Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widget...
CVE-2021-39250: Improper Neutralization of Input During Web Page Generation
Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widget...
PT-2021-22495
Name of the Vulnerable Software and Affected Versions Invision Community versions prior to 4.6.5.1 Description The issue allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker ca...
Invision Community 跨站脚本漏洞
Invision Community is a software for designing and developing mobile application UI from Invision Inc. in the United States. A cross-site scripting vulnerability exists in Invision Community that stems from the product's ability to allow uploading of files into IFRAME elements. The vulnerability...
CVE-2021-34649
The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dark parameter in the /titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2...