sane-backends: Heap buffer overflow in esci2_img

A flaw was found in sane-backends in versions prior to 1.0.30. A heap buffer overflow in the esci2img function could lead to a remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Security Bulletin: OpenStack vulnerabilities affect IBM SmartCloud Entry(CVE-2015-7548, CVE-2015-8749 CVE-2015-1850)

Summary IBM SmartClound Entry is vulnerable to several Openstack Nova vulerabilities, which could allow a local authenticated attacker or a remote attacker to obtain sensitive information Vulnerability Details CVEID: CVE-2015-8749 DESCRIPTION: OpenStack Nova could allow a remote attacker to obtai...

CVE-2018-18405

jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...

Design/Logic Flaw

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

CVE-2018-18405

jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...

CVE-2018-18405

jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...

CVE-2018-18405

jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...

Design/Logic Flaw

DISPUTED jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...

CVE-2018-18405

jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...

CVE-2018-18405

jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry...

CVE-2018-18405

Removed by vendor...

CVE-2018-18405

CVE-2018-18405 is documented as a cross-site scripting (XSS) flaw in jQuery v2.2.2, triggerable by a crafted onerror attribute on IMG elements. The connected PT-2020-8631 entry confirms jQuery 2.2.2 as the affected software and describes the issue as an XSS vulnerability via an IMG onerror handle...

PT-2020-8631 · Jquery · Jquery

Name of the Vulnerable Software and Affected Versions: jQuery version 2.2.2 Description: The issue allows for cross-site scripting XSS attacks via a crafted onerror attribute of an IMG element. Recommendations: For jQuery version 2.2.2, consider disabling the use of the onerror attribute in IMG...

Cross-Site Request Forgery (CSRF)

squirrelmail is vulnerable to cross-site request forgery. Squirrelmail did not sufficiently check arguments to IMG tags in HTML e-mail messages. This could be exploited by an attacker by sending arbitrary e-mail messages on behalf of a squirrelmail user tricked into opening a maliciously crafted...

The vulnerability of the SDL2_image IMG_LoadPCX_RW function in the Simple DirectMedia Layer library, which allows a hacker to cause a system crash.

The vulnerability of the SDL2image IMGLoadPCXRW function in the Simple DirectMediaLayer library is caused by a buffer overflow in the dynamic memory. Exploiting this vulnerability can allow an attacker to cause a service failure remotely...

RHEL 7 : qemu-kvm (RHSA-2020:1116)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1116 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the...

HTML Injection

marky-markdown is vulnerable to HTML Injection. The vulnerability exists as it improperly validates style attribute in img tag, allowing an attacker to pass malicious value...

CentOS: Security Advisory for qemu-img (CESA-2020:0366)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Cerberus FTP Server Cross-Site Scripting Vulnerability (CNVD-2020-07242)

Cerberus FTP Server is a multi-channel Windows FTP server, in addition to containing regular FTP features, it also provides users with file access and management privileges, connection limitations, time, IP access, multi-path priority settings and more. A cross-site scripting vulnerability exists...

Cross site scripting

Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folderup.png IMG element not properly sanitizing user-inserted directory...