GHSA-WGMF-Q9VR-VWW6 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

Summary \PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. PoC Example target script: loadDIR . '/book.xlsx'; $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html$spreadsheet;...

CVE-2024-45046 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In affected versions \PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. As a result an attacker...

CVE-2024-45046 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In affected versions \PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. As a result an attacker...

PHPSpreadsheet 安全漏洞

PhpSpreadsheet is an open source PHP library for reading and writing spreadsheet files from PHPOffice. A security vulnerability exists in PHPSpreadsheet, which stems from PhpOfficePhpSpreadsheetWriterHtml does not clean up spreadsheet style information...

ZDI-09-071: Microsoft Internet Explorer writing-mode Memory Corruption Vulnerability

ZDI-09-071: Microsoft Internet Explorer writing-mode Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-071 October 13, 2009 -- CVE ID: CVE-2009-2531 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Internet Explorer 6 Microsoft Internet Explorer 7...

Microsoft Outlook Express 6 - .XML File Attachment Script Execution

Microsoft Outlook Express 6 - .XML File Attachment Script Execution source: https://www.securityfocus.com/bid/5350/info An error has been reported in Microsoft Outlook Express which may allow malicious XML file attachments to execute arbitrary code in the context of the local system. Code executi...