DRUPAL-CORE-2020-009

Drupal 8 and 9 have a reflected cross-site scripting XSS vulnerability under certain circumstances. An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability...

PT-2020-13649 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions prior to 8.8.10 Drupal Core versions prior to 8.9.6 Drupal Core versions prior to 9.0.6 Description: The issue is related to an Access Bypass vulnerability in Drupal Core, where an attacker can exploit the way HTML is...

PT-2020-6402 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions prior to 8.8.10 Drupal Core versions prior to 8.9.6 Drupal Core versions prior to 9.0.6 Description: A cross-site scripting issue in Drupal Core allows an attacker to exploit the way HTML is rendered for affected forms...

42-markdown (>=1.0.0, <=1.0.1), @58fe/p5 (>=1.3.1, <=2.4.8) +413 more potentially affected by unknown CVE via markdown-it-katex (>=1.1.0, <=2.0.3)

markdown-it-katex NPM version =1.1.0, =1.0.0, =1.3.1, =2.3.0, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =3.0.0, =0.14.0, =1.1.7, =1.0.0, =1.5.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5FF8-JCF9-FW62...

20190403-utils (1.0.0), 30s (>=0.1.0, <=1.3.3) +2467 more potentially affected by unknown CVE via marked (>=0.4.0, <=0.6.3)

marked NPM version =0.4.0, =0.1.0, =1.0.0, =4.13.7-rc4, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =4.0.0, =1.0.0, =2.0.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-CH52-VGQ2-943F...

Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. Recommendation No fix is currently available. Consider...

GHSA-PQPP-2363-649V Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, buttle does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious markdown files. Recommendation No fix is currently available. Consider...

XSS in client rendered block templates in rendr

Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a block. Server side rendering is not affected and is properly escaped. Recommendation Update to version 1.1.4 or later...

GHSA-V5HP-35HW-CW5X XSS in client rendered block templates in rendr

Affected versions of rendr are vulnerable to cross-site scripting when client side rendering is done inside a block. Server side rendering is not affected and is properly escaped. Recommendation Update to version 1.1.4 or later...

OPENSUSE-SU-2020:1275-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.28.4 bsc1174662: + Fix several crashes and rendering issues. + Security fixes: CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925. This update was imported from the...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2020:1275-1 Rating: important References: 1174662 Cross-References: CVE-2020-9862 CVE-2020-9893 CVE-2020-9894 CVE-2020-9895 CVE-2020-9915 CVE-2020-9925 Affected Products: openSUSE Leap 15.2 An update that fixes...

Remote code execution

A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform...

CVE-2020-12456

A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window, due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies, perform...

OPENSUSE-SU-2020:1256-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.28.4 bsc1174662: + Fix several crashes and rendering issues. + Security fixes: CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925. This update was imported from the SUSE:SLE-15:Upda...

Security update for webkit2gtk3 (important)

openSUSE Security Update: Security update for webkit2gtk3 Announcement ID: openSUSE-SU-2020:1256-1 Rating: important References: 1174662 Cross-References: CVE-2020-9862 CVE-2020-9893 CVE-2020-9894 CVE-2020-9895 CVE-2020-9915 CVE-2020-9925 Affected Products: openSUSE Leap 15.1 An update that fixes...

CVE-2020-16304

A buffer overflow vulnerability in imagerendercolorthresh in base/gxicolor.c of Artifex Software GhostScript v9.50 allows a remote attacker to escalate privileges via a crafted eps file. This is fixed in v9.51. Mitigation Mitigation for this issue is either not available or the currently availabl...

SUSE-SU-2020:2232-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - Update to version 2.28.4 bsc1174662: + Fix several crashes and rendering issues. + Security fixes: CVE-2020-9862, CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, CVE-2020-9925...

CVE-2020-16304

A buffer overflow vulnerability in imagerendercolorthresh in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to escalate privileges via a crafted eps file. This is fixed in v9.51...

CVE-2020-16304

A buffer overflow vulnerability in imagerendercolorthresh in base/gxicolor.c of Artifex Software GhostScript v9.18 to v9.50 allows a remote attacker to escalate privileges via a crafted eps file. This is fixed in v9.51...

vBulletin 5.x Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'vBulletin 5.x /ajax/render/widgettabbedcontainertabpanel PHP remote code execution.', 'Description' = %q This module exploits a logic bug within...