CVE-2021-24435

CVE-2021-24435 affects WordPress Titan Framework plugin

CVE-2021-23439

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded a user needs to be tricked into uploading such a file...

CVE-2021-23439

CVE-2021-23439 affects the file-upload-with-preview package prior to version 4.2.0. A file name containing malicious JavaScript can be uploaded when a user is tricked into uploading it, enabling cross-site scripting (XSS) in affected contexts. The issue arises from lack of proper validation/escap...

CVE-2021-23439 Cross-site Scripting (XSS)

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded a user needs to be tricked into uploading such a file...

CVE-2021-23439

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded a user needs to be tricked into uploading such a file...

PT-2021-15525 · Unknown · File-Upload-With-Preview

Name of the Vulnerable Software and Affected Versions: file-upload-with-preview versions prior to 4.2.0 Description: The issue allows a file containing malicious JavaScript code in its name to be uploaded, but this requires a user to be tricked into uploading such a file. Recommendations: For...

file-upload-with-preview 跨站脚本漏洞

file-upload-with-preview is a simple file upload utility that displays a preview of an uploaded image. Written in pure JavaScript. No dependencies. Works with Bootstrap 4 or without frameworks. A cross-site scripting vulnerability exists in file-upload-with-preview, which can be exploited to uplo...

Security update for dovecot23 (moderate)

openSUSE Security Update: Security update for dovecot23 Announcement ID: openSUSE-SU-2021:1225-1 Rating: moderate References: 1187418 1187419 1187420 SLE-19970 Cross-References: CVE-2020-28200 CVE-2021-29157 CVSS scores: CVE-2020-28200 NVD : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2021-93906)

Pimcore is a comprehensive open source enterprise platform for master data management PIM/MDM, user experience management CMS/UX, digital asset management DAM, and e-commerce. cross-site scripting vulnerabilities exist in versions of Pimcore prior to 10.1.2. The vulnerability stems from text valu...

GHSA-W6J8-JC36-X5Q9 Improper Neutralization of Text-Values in Object Version Preview

Text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources...

Improper Neutralization of Text-Values in Object Version Preview

Text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources...

CVE-2021-34435

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file...

Eclipse Theia 访问控制错误漏洞

Eclipse Theia is the Eclipse Foundation's suite of open source Integrated Development Environment frameworks for desktop and web applications based on Visual Studio Code. An access control error vulnerability exists in Eclipse Theia versions 0.3.9 through 1.8.1, which stems from a "mini-browser"...

PT-2021-20529 · Eclipse · Eclipse Theia

Name of the Vulnerable Software and Affected Versions: Eclipse Theia versions 0.3.9 through 1.8.1 Description: The issue allows a previewed HTML file to trigger a remote code execution RCE in the Eclipse Theia IDE, specifically through the "mini-browser" extension. This exploit occurs when a user...

Pimcore 跨站脚本漏洞

Pimcore is a comprehensive open source enterprise platform for master data management PIM/MDM, user experience management CMS/UX, digital asset management DAM, and e-commerce. cross-site scripting vulnerabilities exist in versions of Pimcore prior to 10.1.2. The vulnerability stems from text valu...

CVE-2021-30870

A logic issue existed in the handling of document loads. This issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. Previewing an html file attached to a note may unexpectedly contact remote servers...

CVE-2021-30870

A logic issue existed in the handling of document loads. This issue was addressed with improved state management. This issue is fixed in iOS 15 and iPadOS 15. Previewing an html file attached to a note may unexpectedly contact remote servers...

PT-2021-18929 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15 iPadOS versions prior to 15 Description: A logic issue existed in the handling of document loads, which was addressed with improved state management. Previewing an html file attached to a note may unexpectedly contact...

CVE-2021-25218

In BIND 9.16.19, 9.17.16. Also, version 9.16.19-S1 of BIND Supported Preview Edition When a vulnerable version of named receives a query under the circumstances described above, the named process will terminate due to a failed assertion check. The vulnerability affects only BIND 9 releases 9.16.1...

Moderate: Red Hat Security Advisory: Red Hat Integration Camel Quarkus Tech-Preview 2 security update

An update to the Red Hat Integration Camel Quarkus tech preview is now available. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability...