The vulnerability of the WordPress website content management system lies in the lack of measures to eliminate script-related HTML tags on web pages, allowing attackers to compromise data integrity.

The vulnerability of the WordPress website content management system is related to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

CVE-2015-8032

In Textpattern 4.5.7, an unprivileged author can change an article's markup setting...

Design/Logic Flaw

In Textpattern 4.5.7, an unprivileged author can change an article's markup setting...

CVE-2015-8032

CVE-2015-8032 affects Textpattern 4.5.7. The vulnerability allows an unprivileged author to change an article's markup setting, indicating a permission/ownership flaw in how article markup is managed. The provided sources do not specify an exploit method or a patch/mitigation. The impact is limit...

CVE-2015-8032

In Textpattern 4.5.7, an unprivileged author can change an article's markup setting...

CloudForms: Cross Site Scripting in report menu title / HTML Code Injection

A flaw was found in the Report Menu of Red Hat CloudForms where the title field was not properly sanitized for HTML and JavaScript inputs. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that Content Security Policy can...

The vulnerability of Blink’s web page display mechanism in Google Chrome browser allows attackers to access confidential data.

The vulnerability of Blink’s web page rendering mechanism in Google Chrome browsers is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

The vulnerability of Google Chrome browser developer tools allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of Google Chrome browser developer tools is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker who operates remotely to access confidential data, compromise its integrity, and even cause service failures through a...

The vulnerability of trusted browser types like Google Chrome, due to the lack of standard permission mechanisms, allows attackers to compromise data integrity.

The vulnerability of the trusted browser types Google Chrome is related to the lack of a mechanism for standard permissions. Exploiting this vulnerability allows an attacker to affect data integrity through a specially created HTML page...

libquartz: XXE attacks via job description

The Terracotta Quartz Scheduler is susceptible to an XML external entity attack XXE through a job description. This issue stems from inadequate handling of XML external entity XXE declarations in the initDocumentParser function within xml/XMLSchedulingDataProcessor.java. By enticing a victim to...

PT-2020-18079 · Ibm · Ibm Maximo Asset Management

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0.1 through 7.6.0.2 Description: The issue allows a remote attacker to expose sensitive information or consume memory resources through an XML External Entity Injection XXE attack when processing XML...

DEBIAN-CVE-2020-6527

Insufficient policy enforcement in CSP in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to bypass content security policy via a crafted HTML page...

UBUNTU-CVE-2020-6523

Out of bounds write in Skia in Google Chrome prior to 84.0.4147.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page...

Critical: Red Hat Security Advisory: .NET Core security update

An update for .NET Core is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 8 : .NET Core (RHSA-2020:2989)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2989 advisory. .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

Critical: Red Hat Security Advisory: .NET Core security and bugfix update

An update for .NET Core is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

dotnet: XML source markup processing remote code execution

It was discovered that .NET Core did not properly check the source markup of XML files. A remote, unauthenticated attacker could possibly exploit this flaw to execute arbitrary code by sending specially crafted requests to an application parsing certain kinds of XML files or an ASP.NET Core...

Critical: Red Hat Security Advisory: .NET Core 3.1 security and bugfix update

An update for .NET Core 3.1 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

dotnet: XML source markup processing remote code execution

It was discovered that .NET Core did not properly check the source markup of XML files. A remote, unauthenticated attacker could possibly exploit this flaw to execute arbitrary code by sending specially crafted requests to an application parsing certain kinds of XML files or an ASP.NET Core...

PT-2020-9930 · Eclipse · Eclipse Web Tools Platform

Name of the Vulnerable Software and Affected Versions: Eclipse Web Tools Platform versions prior to 3.18 2020-06 Description: The issue allows XML and DTD files referring to external entities to be exploited, sending the contents of local files to a remote server when edited or validated. This ca...