3435 matches found
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HtmlPolicyBuilder when both noscript and style tags are allowed and allowTextIn is enabled for the style tag. An attacker can execute arbitrary scripts in the context of the user's browser by crafting...
OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
Summary It is observed that OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not...
GHSA-G9GQ-3PFX-2GW2 OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
Summary It is observed that OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not...
PT-2025-48110
Name of the Vulnerable Software and Affected Versions OWASP Java HTML Sanitizer versions 20240325.1 Description OWASP Java HTML Sanitizer is vulnerable to Cross-Site Scripting XSS when the HtmlPolicyBuilder allows noscript and style tags with allowTextIn enabled within the style tag. This occurs...
MAL-2025-191894 Malicious code in testingpkgja (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0bd692e8fc46a3f43477d1f095e7c6e2b9666d2d2c60655ac91efd2be07f5193 Package downloads and starts an external executable. The executable starts the Windows calculator application. Considering this and the package description, th...
CVE-2025-12135 WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting
The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csscode' parameter in all versions up to, and including, 1.0.6 due to a missing capability check on the savecustomecode function. This makes it possible for unauthenticated attackers to inject arbitrary web...
Malicious code in peptest (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1230d903d5782f1a6d2d779ada368260f2c32d9e4f74bfd3ddd8f4df9c570572 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
TencentOS Server 4: perl-Crypt-OpenSSL-RSA (TSSA-2025:0464)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0464 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
EUVD-2025-198180
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript...
MAL-2025-191870 Malicious code in sitoogether (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 09dd85c25ad8d35e40f8afc89c4a7f0322beb48a72db826b13c2142810460ac9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Path Traversal
Liferay Portal is vulnerable to path traversal. The vulnerability is due to improper validation of query strings in the ComboServlet, which allows an attacker to access arbitrary CSS/JS files and repeatedly load them to exploit the system...
CVE-2025-6599
An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50ABVY.6.3C0 and earlier could allow an attacker to perform Slowloris‑style denial‑of‑service DoS attacks. Such attacks may temporarily block legitimate HTTP requests and partially disrupt...
Malicious code in minemeld-core (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 dfe7b8c00b3748b3fe38ffdf3bd69558abb58091ee3347d47003929976ceb457 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
EUVD-2025-178474
Malicious code in hyperion-build-style-loader-lynx npm...
EUVD-2025-180459
Malicious code in algol-elektra-rollup-style-loader npm...
EUVD-2025-176169
Malicious code in style-loader-lint-commitlint-config-angular-bootstrap npm...
EUVD-2025-176109
Malicious code in supernova-hyperion-tailwindcss-optimize-css-assets-webpack-plugin npm...
Malicious code in tree-notify-fire-resolve-scale (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58286446bdb6c6f5f5005a6bc809b0344a781e5d24164ab1e56e1fe30e434940 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...