CVE-2021-43827

discourse-footnote is a library providing footnotes for posts in Discourse. Impact When posting an inline footnote wrapped in tags e.g. ^footnote, the resulting rendered HTML would include a nested , which is stripped by Nokogiri because it is not valid. This then caused a javascript error on top...

Cross-site Scripting (XSS) - Stored in convos-chat/convos

Description Stored XSS via upload File with format .svg when chatting in private conversation. Detail When opening the attachment, some format files will be rendered and loaded on the browser. So it allows executing arbitrary javascript code that was injected into attachment before. Proof of...

The vulnerability of the WPE WebKit browser’s web page rendering module for Safari on iOS, iPadOS, tvOS, watchOS, and macOS lies in type conversion errors, allowing attackers to execute arbitrary code.

The vulnerability of the WPE WebKit browser’s web page rendering module for Safari operating systems—iOS, iPadOS, tvOS, watchOS, and macOS—is related to type conversion errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

123-x-ed-eied (>=1.0.5, <=1.0.6), @builderx-framework/bx-app-service-web (0.0.1) +48 more potentially affected by CVE-2021-43803 via next (>=12.0.0, <=12.0.4)

next NPM version =12.0.0, =1.0.5, =0.0.41, =2.0.2, =2.0.1, =0.0.5, =1.9.6, =0.0.0-34, =1.0.2, =1.0.0, =0.0.2, =0.0.62, =0.7.4-alpha.0, =0.7.4-alpha.0, =0.7.7-alpha.0 and more Source cves: CVE-2021-43803 Source advisory: OSV:GHSA-25MP-G6FV-MQXX...

3nit-components (>=0.0.2, <=0.0.4), 3nit-utils (>=0.3.0, <=1.0.2) +1329 more potentially affected by CVE-2021-43803 via next (>=1.2.3, <=11.1.2)

next NPM version =1.2.3, =0.0.2, =0.3.0, =0.0.0-canary.0, =0.0.1, =1.0.0, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2021-43803 Source advisory: OSV:GHSA-25MP-G6FV-MQXX...

CVE-2021-3983

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit operating systems for iOS, related to the use of memory after it is freed, allows attackers to execute arbitrary code.

The vulnerability of the web page rendering modules in WebKitGTK and WPE for iOS operating systems is related to the use of memory after it is freed during the processing of malicious web content. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Cross-site Scripting (XSS) - Stored in krayin/laravel-crm

Description Stored XSS at Name of Tag Detail When rendering grid for Tag, Name value is not filtered before rendering which can trigger XSS Proof of Concept // PoC.req POST /admin/settings/tags/edit/1 HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:95.0...

CVE-2021-33494

OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering...

CVE-2021-33494

OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering...

Cross site scripting

OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering...

CVE-2021-33494

OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering...

CVE-2021-22951

Unauthorized individuals could view password protected files using viewinline in Concrete CMS previously concrete 5 prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in viewinline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations...

environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks

A flaw was found in the way Unicode standards are implemented in the context of development environments, which have specialized requirements for rendering text. An attacker could exploit this to deceive a human reviewer by creating a malicious patch containing well placed BiDi characters. The...

CVE-2021-33071

Incorrect default permissions in the installer for the IntelR oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33071

Incorrect default permissions in the installer for the IntelR oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33071

Incorrect default permissions in the installer for the IntelR oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

Design/Logic Flaw

Incorrect default permissions in the installer for the IntelR oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2021-33071

Intel oneAPI Rendering Toolkit before version 2021.2 contains a flaw due to incorrect default installer permissions, which may allow an authenticated local user to escalate privileges. Affected product: Intel® oneAPI Rendering Toolkit. Root cause: installer permissions misconfiguration. Impact: l...

CVE-2021-33071

Incorrect default permissions in the installer for the IntelR oneAPI Rendering Toolkit before version 2021.2 may allow an authenticated user to potentially enable escalation of privilege via local access...