29174 matches found
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sanitization process when SVG reference elements such as or are included in the overridden allowed tags. An attacker can execute arbitrary scripts or load external resources by crafting SVG elements with...
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations
Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: = 1.0.3...
GHSA-9WJQ-CP2P-HRGF Loofah: SVG `href` attribute bypasses local-reference restriction
Summary Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it,...
CVE-2026-62528
...
CVE-2026-62524
...
CVE-2026-62504
...
CVE-2026-62489
...
CVE-2026-62478
CVE-2026-62478 affects Oracle E-Business Suite’s Oracle Public Sector Financials (Internal Operations) with affected versions 12.2.3–12.2.15. The vulnerability allows a low-privileged attacker with network access over HTTP to compromise the system, potentially taking over Oracle Public Sector Fin...
CVE-2026-62456
Summary (MODE C): The CVE-2026-62456 affects Oracle E-Business Suite, Oracle HRMS (UK) – Internal Operations. Affected versions are 12.2.3–12.2.15. The vulnerability allows a low-privileged attacker with network access over HTTPS to compromise Oracle HRMS (UK), potentially leading to unauthorized...
CVE-2026-61336
...
CVE-2026-61310
...
CVE-2026-61301
...
CVE-2026-61279
CVE-2026-61279 affects Oracle E-Business Suite Proposals (component: Proposals). Affected versions are 12.2.3 through 12.2.15. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Proposals, potentially enabling unauthorized update/insert/delete and...
CVE-2026-61263
...
CVE-2026-61250
...
CVE-2026-61238
...
CVE-2026-61221
...
CVE-2026-61207
...