7690 matches found
CVE-2022-25875
The package svelte before 3.49.0 are vulnerable to Cross-site Scripting XSS due to improper input sanitization and to improper escape of attributes when using objects during SSR Server-Side Rendering. Exploiting this vulnerability is possible via objects with a custom toString function...
[SECURITY] Fedora 36 Update: webkit2gtk3-2.36.4-1.fc36
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3...
Improper handling of email input
Impact An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: [email protected], Before signing in, claim your money!. This was previously sent to...
CVE-2022-2316
HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site...
CVE-2022-2316
HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site...
Hardcoded credentials
NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...
CVE-2022-31127 Improper handling of email input in next-auth
NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...
The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to insufficient validation of input data, allows attackers to execute arbitrary code or cause service failures.
The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause service failures...
The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to insufficient validation of input data, allows attackers to execute arbitrary code or cause service failures.
The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause service failures...
The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to the use of memory after it is freed, allows attackers to execute arbitrary code or cause service interruptions.
The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code or cause a service failure...
The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to insufficient validation of input data, allows attackers to execute arbitrary code or cause service failures.
The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause service failures...
Malicious code in mixed-reality-remote-rendering (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99f83ba8e96b73186a39a08cb80f7d2478ee60c69bd6aab62ac755f803f5db62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4640 Malicious code in mixed-reality-remote-rendering (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99f83ba8e96b73186a39a08cb80f7d2478ee60c69bd6aab62ac755f803f5db62 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Denial Of Service (DoS)
ghostscript is vulnerable to denial of service. The vulnerability exists due to a NULL pointer dereference allowing an attacker to crash the system when rendering a large number of bits in memory...
Cross-site Scripting (XSS)
Overview svelte is a package for building web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization and to improper escape of attributes when using objects during SSR Server-Side Rendering. Exploiting this vulnerability is...
Insufficient HTML Sanitization
Impact Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views. The problem here stems from multiple issues: - Insufficient...
GHSA-RM89-9G65-4FFR Insufficient HTML Sanitization
Impact Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views. The problem here stems from multiple issues: - Insufficient...
CVE-2022-2085
A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an initdeviceprocs defined for the device that uses it as a prototype that depends upon the number of bits per...
CVE-2022-2085
A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an initdeviceprocs defined for the device that uses it as a prototype that depends upon the number of bits per...
CVE-2022-2085
A NULL pointer dereference vulnerability was found in Ghostscript, which occurs when it tries to render a large number of bits in memory. When allocating a buffer device, it relies on an initdeviceprocs defined for the device that uses it as a prototype that depends upon the number of bits per...