UBUNTU-CVE-2023-45359

An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup...

PT-2024-33281 · Unknown · Lemonldap::Ng

Name of the Vulnerable Software and Affected Versions: LemonLDAP::NG versions prior to 2.19.3 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML into the login page via a username if userControl has been set to a non-default value that...

CVE-2023-45359

An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup...

SSOReady 数据伪造问题漏洞

SSOReady is an open source development tool for enterprise SSO from SSOReady Open Source. A data forgery vulnerability exists in SSOReady, which stems from the vulnerability of the affected version to XML signature bypass attacks...

CVE-2023-45359

An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup...

PT-2024-7276 · Google +4 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 130.0.6723.69 Description: The issue is related to a type confusion error in the V8 JavaScript engine used by Google Chrome and Microsoft Edge, allowing a remote attacker to potentially exploit heap corruption...

The vulnerability of the Skia graphic library used by Microsoft Edge and Google Chrome browsers allows attackers to execute arbitrary code.

The vulnerability of the Skia graphic library in Microsoft Edge and Google Chrome exists due to a boundary error in processing untrusted HTML content. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

The vulnerability of Google Chrome’s Autofill function allows a hacker to replace the user interface.

The vulnerability of Google Chrome’s Autofill function is related to information representation errors in the user interface. Exploiting this vulnerability could allow an attacker to replace the user interface through a specially created HTML page...

The vulnerability of the Blink web browser component in Google Chrome, which allows a hacker to compromise data integrity

The vulnerability of the Blink web browser component in Google Chrome relates to the lack of protective measures for the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise data integrity through a specially created HTML page...

WordPress plugin ProfileGrid 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A post-release reuse vulnerability exists in versions of Google Chrome prior to 129.0.6668.70, which can be exploited by a remote attacker to potentially leverage heap corruption via a crafted HTML page...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in versions of Google Chrome prior to 129.0.6668.70, which can be exploited by remote attackers to perform memory access via specially crafted Hypertext Markup Language pages...

DEBIAN-CVE-2024-7019

Inappropriate implementation in UI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Apache HertzBeat 代码问题漏洞

Apache HertzBeat is a tool from the American company Apache Apache that can monitor various components. A deserialization vulnerability exists in Apache HertzBeat versions prior to 1.6.0, which stems from the insecure deserialization of serialized data received from users by the SnakeYAML library...

PT-2024-29883 · Galaxy · Galaxy

Name of the Vulnerable Software and Affected Versions: Galaxy versions prior to the latest patched version Description: The issue concerns the editor visualization, specifically the "/visualizations" endpoint, which can be used to store HTML tags and trigger javascript execution upon an edit...

The vulnerability of the Reporter Widget component in the Veeam ONE monitoring software allows a attacker to execute arbitrary HTML code.

The vulnerability of the Reporter Widgets component of the Veeam ONE monitoring software lies in the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code remotely...

rexml: DoS vulnerability in REXML

An uncontrolled resource consumption vulnerability was found in REXML. When parsing an untrusted XML with many specific characters such as , it can lead to a denial of service...

rexml: DoS vulnerability in REXML

A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file...

Guardrails 安全漏洞

Guardrails is a Python framework open-sourced by Guardrails AI. A security vulnerability exists in Guardrails versions 0.2.9 through 0.5.0 and earlier, which stems from its improper validation of an XML file, such that if a victim loads an XML file containing malicious Python code, the code will ...

rexml: DoS vulnerability in REXML

A flaw was found in the REXML package. Reading an XML file that contains many entity expansions may lead to a denial of service due to resource starvation. An attacker can use this flaw to trick a user into processing an untrusted XML file...