Cross-site Scripting in Sanitize

When HTML is sanitized using Sanitize's "relaxed" config or a custom config that allows certain elements, some content in a or element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config o...

Microsoft Releases June 2020 Security Patches For 129 Vulnerabilities

Microsoft today released its June 2020 batch of software security updates that patches a total of 129 newly discovered vulnerabilities affecting various versions of Windows operating systems and related products. This is the third Patch Tuesday update since the beginning of the global Covid-19...

CVE-2020-9788

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.5. A file may be incorrectly rendered to execute JavaScript...

Input validation

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Catalina 10.15.5. A file may be incorrectly rendered to execute JavaScript...

CVE-2020-9788

The CVE-2020-9788 entry describes a validation/input sanitization issue in macOS where a file may be rendered in a way that could execute JavaScript. The vulnerability is addressed in macOS Catalina 10.15.5, with Apple noting improved input sanitization as the fix. Public references also align wi...

Security Vulnerabilities fixed in Firefox 77 — Mozilla

NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. Mozilla Developer Iain Ireland...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: User Email Verification Bypass OAuth Flow Missing Email Verification Checks Notification Email Verification Bypass Undisclosed Vulnerability on a Third-Party Rendering Engine Group Sign-Up Restriction Bypass Mirror Project Owner Impersonation Missing Permission Check on Fork...

openSUSE Security Update : freetype2 (openSUSE-2020-704)

This update for freetype2 to version 2.10.1 fixes the following issues : Security issue fixed : - CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c bsc1079603. Non-security issues fixed : - Update to version 2.10.1 - The bytecode hinting of OpenType variation fonts was flawed, sinc...

Security update for freetype2 (moderate)

openSUSE Security Update: Security update for freetype2 Announcement ID: openSUSE-SU-2020:0704-1 Rating: moderate References: 1079603 1091109 Cross-References: CVE-2018-6942 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...

SUSE SLED15 / SLES15 Security Update : freetype2 (SUSE-SU-2020:1353-1)

This update for freetype2 to version 2.10.1 fixes the following issues : Security issue fixed : CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c bsc1079603. Non-security issues fixed : Update to version 2.10.1 - The bytecode hinting of OpenType variation fonts was flawed, since th...

Cross-Site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS. The $attachment variable in \htdocs\document.php prompts for the open/save dialogue box when it is set to true. A remote attacker is able to modify the parameter to false and cause the file is to be rendered in a user's browser...

UBUNTU-CVE-2020-13239

The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS...

SUSE-SU-2020:1353-1 Security update for freetype2

This update for freetype2 to version 2.10.1 fixes the following issues: Security issue fixed: - CVE-2018-6942: Fixed a NULL pointer dereference within ttinerp.c bsc1079603. Non-security issues fixed: - Update to version 2.10.1 The bytecode hinting of OpenType variation fonts was flawed, since the...

PT-2020-13389 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 11.0.4 Description: The issue concerns the DMS/ECM module, which renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link, leading to a Cross-Site Scripting XSS...

SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2020:1211-1)

This update for webkit2gtk3 fixes the following issues : Security issue fixed : CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed : Update to version 2.28.2 bsc1170643 : + Fix excessive CPU usage due to GdkFrameClock...

openSUSE Security Update : webkit2gtk3 (openSUSE-2020-646)

This update for webkit2gtk3 fixes the following issues : Security issue fixed : - CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed : - Update to version 2.28.2 bsc1170643 : + Fix excessive CPU usage due to...

SUSE-SU-2020:1211-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issue fixed: - CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed: - Update to version 2.28.2 bsc1170643: + Fix excessive CPU usage due to GdkFrameClock...

Fedora 31 : webkit2gtk3 (2020-7f34d2cfd8)

Update to 2.28.2 : - Fix excessive CPU usage due to GdkFrameClock not being stopped. - Fix UI process crash when EGLWLbindwaylanddisplay extension is not available. - Fix position of select popup menus in X11. - Fix playing of Youtube live stream/H264 URLs. - Fix several crashes and rendering...

The vulnerability of the WordPress website content management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the integrity of data.

The vulnerability of the WordPress content management system’s functions is related to an error in the execution of XSS attacks during shortcode rendering. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

SUSE-SU-2020:1198-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Security issue fixed: - CVE-2020-3899: Fixed a memory consumption issue that could have led to remote code execution bsc1170643. Non-security issues fixed: - Update to version 2.28.2 bsc1170643: + Fix excessive CPU usage due to GdkFrameClock...