Mozilla: Use-after-free in XSL (MFSA 2017-02)

Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird 45.7, Firefox ESR 45.7, and Firefox 51...

CVE-2016-8999

CVE-2016-8999 affects IBM InfoSphere Information Server and related components (InfoSphere DataStage; InfoSphere Information Server on Cloud). The vulnerability is a path-relative stylesheet import issue that can cause a page to render in quirks mode, enabling an attacker to inject malicious CSS....

CVE-2016-8999

IBM InfoSphere Information Server contains a Path-relative stylesheet import vulnerability that allows attackers to render a page in quirks mode thereby facilitating an attacker to inject malicious CSS...

CVE-2017-2970

Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable heap overflow vulnerability in the XSLT engine related to template manipulation. Successful exploitation could lead to arbitrary code execution...

Adobe Acrobat and Reader Buffer Overflow (APSB17-01: CVE-2017-2948)

A buffer overflow vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to an error while parsing a corrupted PDF file containing an XSL stylesheet. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file...

Adobe Acrobat and Reader Heap Overflow (APSB17-01: CVE-2017-2949)

A heap overflow vulnerability exists in Adobe Reader and Acrobat. The vulnerability is due to an error while parsing a corrupted PDF file containing an XSL stylesheet. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted PDF file...

PT-2022-7408 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.0 Description: The issue is related to the use of ticket followups or setup login messages with a stylesheet link in GLPI, which may allow for a cross-site scripting attack vector. This is partially mitigated by th...

Open-Xchange: OX Guard: DOM Based Cross-Site Scripting

Summary OX Guard's "Guest Reader" is vulnerable to DOM Based XSS. The vulnerable parameter is "templid". The reader.js script see below takes the parameter's value and injects it into the page/DOM without encoding/sanitizing it first. PoC:...

Adobe Flash StyleSheet Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the StyleSheet...

DEBIAN-CVE-2016-4324

Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens...

Design/Logic Flaw

Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens...

CVE-2016-4324

CVE-2016-4324 : A use-after-free vulnerability exists in the LibreOffice RTF parser, triggered by parsing crafted RTF files containing a specific combination of stylesheet and superscript tokens. Exploitation could allow arbitrary code execution. Public technical details in connected documents co...

The vulnerability of the Apache Tomcat software allows a malicious attacker to compromise the confidentiality of protected information.

The vulnerability exists in Apache Tomcat due to an improper restriction on the loader class that has access to the XML processor used in XSLT style sheets. This allows malicious actors to read arbitrary files using a specially crafted application that declares external XML entities and contains...

A vulnerability in the Mozilla SeaMonkey software product, which allows a malicious individual to execute arbitrary code.

Mozilla SeaMonkey’s software product contains a vulnerability related to an implementation error in the content protection policy when working with XSLT style sheets. Exploiting this vulnerability allows malicious actors to execute arbitrary XSLT code, despite the insufficient restrictions impose...

CVE-2016-4324

Use-after-free vulnerability in LibreOffice before 5.1.4 allows remote attackers to execute arbitrary code via a crafted RTF file, related to stylesheet and superscript tokens...

CVE-2016-1692

WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a ServiceWorker even when the stylesheet download has an incorrect MIME type, which allows remote attackers to bypass the Same Origin Policy via...

chromium-browser: limited cross-origin bypass in serviceworker

WebKit/Source/core/css/StyleSheetContents.cpp in Blink, as used in Google Chrome before 51.0.2704.63, permits cross-origin loading of CSS stylesheets by a ServiceWorker even when the stylesheet download has an incorrect MIME type, which allows remote attackers to bypass the Same Origin Policy via...

DEBIAN-CVE-2016-1564

Multiple cross-site scripting XSS vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a 1 stylesheet name or 2 template name to wp-admin/customize.php...

CVE-2016-1564

Multiple cross-site scripting XSS vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a 1 stylesheet name or 2 template name to wp-admin/customize.php...

UBUNTU-CVE-2016-1564

Multiple cross-site scripting XSS vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a 1 stylesheet name or 2 template name to wp-admin/customize.php...