235 matches found
CVE-2018-18909
xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...
CVE-2018-18909
xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...
CVE-2018-18909
xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...
CVE-2018-18909
The CVE-2018-18909 entry applies to xhEditor (version 1.2.2). The underlying issue is a cross-site scripting (XSS) vulnerability: an attacker can inject JavaScript code in the SRC attribute of an IFRAME element within the editor’s source-code view. This is evidenced by multiple connected records ...
CVE-2018-18909: Improper Neutralization of Input During Web Page Generation
xhEditor 1.2.2 allows XSS via JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view...
PT-2018-14716
Name of the Vulnerable Software and Affected Versions xhEditor version 1.2.2 Description The issue allows for cross-site scripting XSS attacks through JavaScript code in the SRC attribute of an IFRAME element within the editor's source-code view. Recommendations For xhEditor version 1.2.2, consid...
CVE-2018-18361
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...
CVE-2018-18361: Improper Neutralization of Input During Web Page Generation
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...
CVE-2018-14399
libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...
CVE-2018-14399
libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...
CVE-2018-14399: Improper Control of Generation of Code
libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...
CVE-2018-5162: Missing Encryption of Sensitive Data
Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR 52.8 and Thunderbird 52.8...
Mozilla: Encrypted mail leaks plaintext through src attribute
Plaintext of decrypted emails can leak through the src attribute of remote images, or links. This vulnerability affects Thunderbird ESR 52.8 and Thunderbird 52.8...
PT-2018-3742
Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 52.8 Thunderbird ESR versions prior to 52.8 Description The issue is related to information disclosure. It allows a remote attacker to gain unauthorized access to protected information through the src attribute of...
CVE-2018-9140
On Samsung mobile devices with M6.0 software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE-2017-10747...
CVE-2018-9140
On Samsung mobile devices with M6.0 software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE-2017-10747...
PT-2018-18882
Name of the Vulnerable Software and Affected Versions Samsung mobile devices with M6.0 software Description The issue affects the Email application, allowing for cross-site scripting XSS via an event attribute and arbitrary file loading via a src attribute. Recommendations For Samsung mobile...
CVE-2018-9140: Improper Neutralization of Input During Web Page Generation
On Samsung mobile devices with M6.0 software, the Email application allows XSS via an event attribute and arbitrary file loading via a src attribute, aka SVE-2017-10747...