SUSE CVE-2018-12373

dDecrypted S/MIME parts hidden with CSS or the plaintext HTML tag can leak plaintext when included in a HTML reply/forward. This vulnerability affects Thunderbird 52.9...

UBUNTU-CVE-2022-45418

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Remote Code Execution

xalan:xalan is vulnerable to remote code execution. An attacker is able to corrupt Java class files generated by the internal XSLTC compiler and execute harmful Java bytecodes on the host machine due to an integer truncation flaw which occurs during XSLT style sheet processing...

Mozilla: Leaking browser history with CSS variables

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes the issue of Firefox behaving slightly differently for already known resources when loading CSS resources involving CSS variables. This flaw could probe the browser history...

Cross-site Scripting (XSS)

org.owasp.antisamy:antisamy is vulnerable to cross-site scriptingXSS attacks. The output serializer does not properly encode the cascading style sheetCSS content, allowing an attacker to conduct HTML tag smuggling on STYLE content with the use of a specifically crafted user input, resulting in...

Mozilla: Heap-buffer-overflow in blendGaussianBlur

The Mozilla Foundation Security Advisory describes this flaw as: Applying a CSS filter effect could have accessed out-of-bounds memory. This could have led to a heap-buffer-overflow, causing a potentially exploitable crash...

cxf: XSS via the styleSheetPath

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...

cxf: XSS via the styleSheetPath

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2021-48501)

CMS Made Simple CMSMS is an open source content management system that provides developers, programmers, and website owners with a web-based version of the development and management interface. A stored cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14, which can be...

CMS Made Simple 跨站脚本漏洞

CMS Made Simple CMSMS is an open source content management system that provides developers, programmers, and website owners with a web-based version of the development and management interface. A stored cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14, which can be...

Apache CXF Cross-Site Scripting Vulnerability (CNVD-2020-66585)

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. A cross-site scripting vulnerability exists in Apache CXF version 3.4.1 and all version...

ALSA-2020:3654 Moderate: libcroco security update

The libcroco is a standalone Cascading Style Sheet level 2 CSS2 parsing and manipulation library. Security Fixes: libcroco: Stack overflow in function crparserparseanycore in cr-parser.c CVE-2020-12825 For more details about the security issues, including the impact, a CVSS score, acknowledgments...

The vulnerability of the PPTStyleSheet function in the PowerPoint file analyzer of the Apache OpenOffice office package allows a hacker to execute arbitrary code.

The vulnerability of the PPTStyleSheet function in the Apache OpenOffice office package’s PPT file analyzer is related to data writing beyond the buffer limit. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

UBUNTU-CVE-2017-12607

A vulnerability in OpenOffice's PPT file parser before 4.1.4, and specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause denial of service memory corruption and application crash potentially resulting in arbitrary code execution...

Avito: CSS injection in avito.ru via IE11

Hi Team Security @avito I discovered CSS Injection on avito.ru in form search via IE11 Description CSS injection vulnerabilities arise when an application imports a style sheet from a user-supplied URL, or embeds user input in CSS blocks without adequate escaping. They are closely related to...

phpMyAdmin CSS Injection Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A CSS injection vulnerability exists in phpMyAdmin. The vulnerability can be exploited to inject CSS with the help of a specially crafted cookie parameter...

The vulnerability of Google Chrome browser allows a violator to circumvent existing access restrictions policies.

The vulnerability in the WebKit/Source/core/css/StyleSheetContents.cpp file of the Google Chrome browser’s Blink component is related to errors in CSS style sheet access control. Exploiting this vulnerability could allow a malicious actor to circumvent existing access restrictions by using a...

UBUNTU-CVE-2016-1634

Use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in WebKit/Source/core/css/resolver/StyleResolver.cpp in Blink, as used in Google Chrome before 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted...

chromium: use-after-free in DOM, fixed in Chrome 38.0.2125.101

Use-after-free vulnerability in the ProcessingInstruction::setXSLStyleSheet function in core/dom/ProcessingInstruction.cpp in the DOM implementation in Blink, as used in Google Chrome before 38.0.2125.101, allows remote attackers to cause a denial of service or possibly have unspecified other...

Netscape 6.0/7.0 Style Sheet Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6937/info It has been reported that Netscape based browsers may be vulnerable to a denial of service condition when rendering certain style sheet code. If a malicious page is viewed the browser reportedly becomes unstable...