GHSA-MVMF-CVFX-QG55 Regular Expression Denial of Service in bleach

All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this issue, it is...

Regular Expression Denial of Service in bleach

All versions of the bleach package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. Recommendation The bleach package is not currently maintained, and has not seen an update since 2014. To mitigate this issue, it is...

CVE-2020-24316

WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...

Change WordPress Login Logo < 1.1.5 - Authenticated Stored Cross-Site Scripting

The height, and width fields used to update the custom logo was found to be vulnerable to stored XSS, as they did not sanitize user input properly before publishing the changes. It is triggered when a user loads the login page. PoC Set the following payload as Height or Width in the plugin's...

CVE-2020-1580

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

CVE-2020-1591

A cross site scripting vulnerability exists when Microsoft Dynamics 365 on-premises does not properly sanitize a specially crafted web request to an affected Dynamics server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected Dynamics...

Responsive Lightbox2 < 1.0.3 - Authenticated Stored Cross-Site Scripting

The ‘hyperlink’ field in used while linking an image from a URL was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using...

Easy Media Download < 1.1.5 - Authenticated Stored Cross-Site Scripting

The ‘Button Text’ field in used while posting a file download was found to be vulnerable to stored XSS, as they did not sanitize user given input properly before publishing the post. It is triggered when a users loads a page where the plugin shortcode is used. All WordPress websites using Easy...

The vulnerabilities of the formatting.php and SanitizeFileName.php components of the WordPress content management system allow attackers to compromise data integrity.

The vulnerability of the formatting.php and SanitizeFileName.php components of the WordPress content management system is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...

GHSA-32VW-R77C-GM67 Withdrawn Advisory: marked cross-site scripting vulnerability

Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set...

GHSA-GM9X-Q798-HMR4 Command Injection in git-tags-remote

All versions of git-tags-remote are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an exec call on the get function . This may allow attackers to execute arbitrary code in the system if the repo value passed to the function is...

Security Bulletin: CVE-2014-3524 CSV Injection in reports

Summary Cells in csv reports need to sanitize for legacy CSV Injection concerns. Vulnerability Details Third Party Entry: PSIRT-ADV0017245 DESCRIPTION: Created from Advisory: ADV0017245 CVSS Base score: 8.1 CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected Products and Versions...

Debian: Security Advisory (DSA-4730-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DSA-4730-1 : ruby-sanitize - security update

Michal Bentkowski discovered that ruby-sanitize, a whitelist-based HTML sanitizer, is prone to a HTML sanitization bypass vulnerability when using the 'relaxed' or a custom config allowing certain elements. Content in a or element may not be sanitized correctly even if math and svg are not in the...

[SECURITY] [DSA 4730-1] ruby-sanitize security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4730-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 19, 2020 https://www.debian.org/security/faq -...

DSA-4730-1 ruby-sanitize - security update

Bulletin has no description...

NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44584)

NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. NeDi Consulting A cross-site scripting vulnerability exists in the 'sanitize' function of the inc/libmisc.php file in NeDi version 1.9C. The...

CVE-2020-14413

Summary of CVE-2020-14413 : NeDi 1.9C is vulnerable to cross-site scripting due to an incorrect implementation of sanitize() in inc/libmisc.php. The function attempts to escape SCRIPT tags from user-controlled values but can be bypassed, with an example using an onerror attribute in an IMG tag (D...

CVE-2020-14413

NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta=...

Cross-site Scripting (XSS)

Overview sanitize is a Ruby HTML and CSS sanitizer. Affected versions of this package are vulnerable to Cross-site Scripting XSS. When HTML is sanitized using Sanitize's "relaxed" config or a custom config that allows certain elements, some content in a or element may not be sanitized correctly...