Content Injection

Overview Affected versions of this package are vulnerable to Content Injection. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting XSS vulnerability,...

Moderate: Red Hat Security Advisory: webkitgtk4 security update

An update for webkitgtk4 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

PT-2022-1865 · Microsoft · Dynamics 365

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 on-premises affected versions not specified Description: The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to conduct spoofing attacks...

The vulnerability in the WebAuthentication browser implementation by Google Chrome, related to the use of memory after it is freed, allows a hacker to compromise the user’s rendering process.

The vulnerability of the WebAuthentication browser implementation by Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to compromise the rendering process of a user whose credit card is stored in their Google account...

EulerOS Virtualization 3.0.2.6 : grub2 (EulerOS-SA-2021-2868)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot i...

xorg-x11-server: SProcRenderCompositeGlyphs out-of-bounds access

A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the SProcRenderCompositeGlyphs function due to improper validation of the request length...

Exposure of Sensitive Information to an Unauthorized Actor in hoppscotch/hoppscotch

Description Steal authorization token via xss and hijack attack Proof of Concept Using this attack , attacker can hijack account by stealing authorization header . I see there is team based collaboration exists ,so one user can hack other user account using this bug . STEP -------- First host...

PT-2025-8146

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, specifically an out-of-bounds OOB read when handling the Post Cursor2 register. The issue was found in the drm dp get adjust reques...

PT-2025-37514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's DRM/MSM subsystem related to inconsistent handling of hardware shutdown logic in the .remove and .shutdown callbacks. The .remove and .shutdown...

poppler bug fix and enhancement update

Poppler is a Portable Document Format PDF rendering library, used by applications such as Evince. Bug Fixes and Enhancements: Unable to open certain PDF documents BZ2002691...

Remote Code Execution in npm-groovy-lint

Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable...

GHSA-QC22-QWM9-J8RX Remote Code Execution in npm-groovy-lint

Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to the execution of operations beyond the buffer boundaries in memory, allows attackers to execute arbitrary code.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the escape of operations beyond the buffer in memory when processing HTML content. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created malicious...

CVE-2021-43837

vault-cli is a configurable command-line interface tool and python library to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix !template!, vault-cli interprets the rest of the contents of th...

PYSEC-2021-853

vault-cli is a configurable command-line interface tool and python library to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix !template!, vault-cli interprets the rest of the contents of th...

PYSEC-2021-853

vault-cli is a configurable command-line interface tool and python library to interact with Hashicorp Vault. In versions before 3.0.0 vault-cli features the ability for rendering templated values. When a secret starts with the prefix !template!, vault-cli interprets the rest of the contents of th...

GNOME Web 跨站脚本漏洞

GNOME Web Epiphany is a Web browser based on the WebKit rendering engine. The product provides paginated browsing, cookie management, pop-up ad control, etc. GNOME Web has a cross-site scripting vulnerability that can be exploited by attackers to conduct exploit attacks via false pages...

The vulnerability of the WPE WebKit browser’s web page rendering module in Safari for iOS, iPadOS, tvOS, watchOS, macOS lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of the WPE WebKit browser’s web page rendering module in Safari for iOS, iPadOS, tvOS, watchOS, and macOS relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Blink’s web page display mechanism in Google Chrome browser allows attackers to carry out spoofing attacks.

The vulnerability of Blink’s web page rendering mechanism in Google Chrome browsers is related to errors in the implementation of security checks for standard elements. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

The vulnerability of the Blink rendering module in Microsoft Edge browsers allows attackers to circumvent existing access restrictions.

The vulnerability of the Blink display module in Microsoft Edge browsers is related to privilege management errors. Exploiting this vulnerability could allow a remote attacker to circumvent existing access restrictions...