244 matches found
Code injection
plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements...
CVE-2019-9870
plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements...
CVE-2019-9870
CVE-2019-9870 affects the w8tcha CKEditor oEmbed plugin prior to 2019-03-14. The vulnerability stems from how plugin.js mishandles SCRIPT elements, enabling a NETWORK-exposed issue with LOW attack complexity and no required user interaction. NVD records CVSS v3.0 base score 9.8 (CRITICAL) with HI...
CVE-2019-9870: Undefined Security Weakness
plugin.js in the w8tcha oEmbed plugin before 2019-03-14 for CKEditor mishandles SCRIPT elements...
Valve: code injection, steam chat client
The steam chat client allows oEmbed, apparently based on a whitelist. One of the whitelisted oEmbedis codepen. When a codepen is created, it can be sent as a link to another steam user, and the code inside the codepen will execute within the privileged Steam Chat context. You can send these codep...
LinkedIn: Persistent XSS (unvalidated Open Graph embed) at LinkedIn.com
This report was previously published on Medium.com/@JonathanBouman. Follow me on Twitter or Medium for new reports. F361972 Proof of concept Background In my previous report we learned more about a special type of the persistent XSS attack; the unvalidated oEmbed attack. This attack allows us to...
CVE-2016-10569
The CVE-2016-10569 issue affects the embedza module prior to version 1.2.4, where JavaScript resources are downloaded over HTTP. This enables a man-in-the-middle scenario where an attacker on the network could swap the requested JavaScript with a malicious file, potentially leading to remote code...
CVE-2016-10569
embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed, Open Graph, meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the...
FreeBSD : wordpress -- multiple issues (a48d4478-e23f-4085-8ae4-6b3a7b6f016b)
wordpress developers report : Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting attack in the link modal via a javascript: or data: URL. Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in the template list view via a crafted template name. Before...
Cross-site Scripting (XSS)
WordPress is vulnerable to cross-site scripting XSS attacks. The library does not properly handle HTML elements in the oEmbed sandbox before rendering, allowing a malicious user to inject and execute arbitrary webscript...
WordPress 4.4-4.8.1 - Cross-Site Scripting (XSS) in oEmbed
Description A cross-site scripting XSS vulnerability was discovered in the oEmbed discovery. Reported by xknown of the WordPress Security Team...
WordPress oEmbed discovery cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on servers with PHP and MySQL. oEmbed discovery is one of the oEmbed search plugin. A cross-site scripting vulnerability exists in oEmbed...
CVE-2017-14724
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery...
UBUNTU-CVE-2017-14724
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery...
Cross site scripting
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery...
DEBIAN-CVE-2017-14724
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery...
CVE-2017-14724
CVE-2017-14724 affects WordPress prior to 4.8.2, where oEmbed discovery is vulnerable to cross-site scripting. The issue is triggered via oEmbed discovery paths and is exploitable by unauthenticated actors under network conditions; impact is listed as partial integrity leakage and low confidentia...
CVE-2017-14724
Before version 4.8.2, WordPress was vulnerable to cross-site scripting in oEmbed discovery...
