370 matches found
Cross site scripting
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of...
SUSE-SU-2023:0094-1 Security update for python36-setuptools
This update for python36-setuptools fixes the following issues: - CVE-2022-40897: Fixed an excessive CPU usage that could be triggered by fetching a malicious HTML document bsc1206667...
Tiny Technologies TinyMCE 跨站脚本漏洞
Tiny Technologies TinyMCE is a rich text editor from Tiny Technologies, Inc. Tiny Technologies TinyMCE suffers from a cross-site scripting vulnerability that originates from cross-site scripting that can be achieved when an attacker serves malicious HTML content to its warning and confirmation...
Darknet's Largest Mobile Malware Marketplace Threatens Users Worldwide
Cybersecurity researchers have shed light on a darknet marketplace called InTheBox that's designed to specifically cater to mobile malware operators. The actor behind the criminal storefront, believed to be available since at least January 2020, has been offering over 400 custom web injects group...
Heap Buffer Overflow
bash is vulnerable to a heap buffer overflow. The vulnerability exists in validparametertransform function of subst.c which allows an attacker to crash the system through potentially exploit heap corruption via a malicious HTML page...
Use After Free
chromium:sid is vulnerable to use after free. It allowed a remote attacker to potentially exploit heap corruption via a malicious HTML page...
Add Client function is vulnerable to stored HTML injection
Description HTML Injection also termed as “virtual defacements” is one of the most simple and the most common vulnerability that arises when the web-page fails to sanitize the user-supplied input or validates the output, which thus allows the attacker to craft his payloads and injects the malicio...
Denial Of Service (DoS)
chromium is vulnerable to denial of service. The vulnerability exists due to the out of bound read in the Dawn, allowing an attacker to crash the application by providing a maliciously crafted HTML page...
CVE-2022-34160
IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 229330...
Phishing Attack
next-auth is vulnerable to phishing attacks. A remote attacker is able to pass a specifically crafted input to the e-mail signin endpoint which contains malicious HTML, tricking the e-mail server to send it to the user which allows the attacker to perform phishing attacks on the victim...
IBM Jazz Team Server 跨站脚本漏洞
IBM Jazz Team Server is an application server from IBM Corporation. provides base services that enable a group of tools to work together as a single logical server and includes any number of Jazz Team Server Extensions that provide tool-specific functionality.An HTML injection vulnerability exist...
Use-After-Free
chromium is vulnerable to use-after-free. The vulnerability exists in performance manager due to heap corruption which allows an attacker to crash the application via a malicious HTML page...
GHSA-CMV8-6362-R5W9 Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...
GHSA-42GQ-H7XJ-33R4 Features file injection vulnerability
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory...
Features file injection vulnerability
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory...
CVE-2022-26947
Archer 6.x through 6.9 SP3 6.9.3.0 contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...
swagger-ui-dist 安全漏洞
swagger-ui-dist is a module that exposes the entire dist folder of Swagger-UI as a dependency-free npm module. A security vulnerability exists in Node.js swagger-ui-dist versions prior to 4.1.3, which stems from a lack of effective filtering and validation of html code. An attacker can write...
GHSA-72WF-HWCQ-65H9 Cross-Site Request Forgery in Filebrowser
A Cross-Site Request Forgery CSRF vulnerability exists in Filebrowser 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim...
