3519 matches found
Mozilla: Custom mouse cursor could have been drawn over browser UI
The Mozilla Foundation Security Advisory describes this flaw as: If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks...
CVE-2022-45082
Multiple Auth. admin+ Stored Cross-Site Scripting XSS vulnerabilities in Accordions plugin = 2.0.3 on WordPress via &addons-style-name and &accordionsorfaqslicensekey...
PT-2022-27403 · Accordion · Accordion
Name of the Vulnerable Software and Affected Versions: Accordions plugin versions prior to 2.0.4 Description: The issue concerns Stored Cross-Site Scripting XSS vulnerabilities. These vulnerabilities can be exploited via the &addons-style-name and &accordions or faqs license key parameters...
WordPress plugin Accordions 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
ovirt-engine: RHVM admin password is logged unfiltered when using otopi-style
A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss...
UBUNTU-CVE-2022-45418
If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...
The vulnerability of the library for performing fast, customizable HTML AntiSamy cleanup is related to incorrect encoding of the content in cascading style tables. This allows attackers to perform cross-site scripting attacks.
The vulnerability of the library for performing fast, customizable HTML AntiSamy cleaning is related to incorrect encoding of the content in cascading style sheets. Exploiting this vulnerability could allow a remote attacker to perform cross-site scripting attacks using HTML tags...
AZL-83613 CVE-2022-45061 affecting package docbook5-style-xsl 1.79.2-11
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
owasp-java-html-sanitizer: improper policies enforcement may lead to remote code execution
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements...
CVE-2022-35739
PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary content into the style tag for that device. When the device page loads, the arbitrary Cascading Style Sheets CSS data is inserted into the style tag, loading...
Cross site scripting
PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary content into the style tag for that device. When the device page loads, the arbitrary Cascading Style Sheets CSS data is inserted into the style tag, loading...
Paessler PRTG Network Monitor 跨站脚本漏洞
Paessler PRTG Network Monitor is a full-featured network monitoring and management software from Paessler, Germany. A cross-site scripting vulnerability exists in PRTG Network Monitor version 22.2.77.2204, which originates from the fact that it does not block custom input for device icons and can...
CVE-2022-35739
PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary content into the style tag for that device. When the device page loads, the arbitrary Cascading Style Sheets CSS data is inserted into the style tag, loading...
PT-2022-22956 · Paessler · Prtg Network Monitor
Name of the Vulnerable Software and Affected Versions: PRTG Network Monitor versions prior to 22.2.77.2205 Description: The issue allows custom input for a device's icon, which can be modified to insert arbitrary content into the style tag for that device. When the device page loads, the arbitrar...
CVE-2022-2805
A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss...
ovirt-engine 信息泄露漏洞
ovirt-engine is an open source virtualization management engine. An information disclosure vulnerability exists in ovirt-engine that stems from recording plaintext passwords in log files when using otapi style. An attacker could exploit this vulnerability to read the log file, which could result ...
CVE-2022-2805
The CVE-2022-2805 entry concerns the ovirt-engine component where plaintext passwords are logged when using otapi-style, enabling a sufficiently privileged attacker to read log files and obtain confidential data. Affected product: ovirt-engine (Red Hat Virtualization Manager). Root cause: logging...