4811 matches found
Cross-Site Scripting bypass
Overview All versions of html-purify are vulnerable to cross-site scripting. The data attribute inside of object tags is not properly sanitized and allows javascript URIs leading to code execution. Recommendation No fix is currently available. Consider using an alternative package until a fix is...
php: Out of bounds read in php_strip_tags_ex
When using fgetss function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash...
The vulnerability of the user interface of Cisco Webex Meetings software allows attackers to perform cross-site scripting attacks.
The vulnerability of the user interface of Cisco Webex Meetings software relates to the lack of measures taken to eliminate script-related tags on web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
The vulnerability in the web interface of the Cisco Webex Teams collaboration software allows a perpetrator to carry out cross-site scripting attacks.
The vulnerability of the Cisco Webex Teams software interface relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
Dundas BI server cross-site scripting vulnerability
Dundas BI server is a web-based server application. A cross-site scripting vulnerability exists in Dundas BI version 8.0.0.1001 and prior versions, which stems from allowing XSS attacks via HTML tags when creating or editing dashboards. No detailed vulnerability details are currently available...
PCWT - A Web Application That Makes It Easy To Run Your Pentest And Bug Bounty Projects
A web application that makes it easy to run your pentest and bug bounty projects. Description The app provides a convenient web interface for working with various types of files that are used during the pentest, automate port scan and subdomain search. Main page Project settings Domains dashboard...
CVE-2020-26211
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of javascript: URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a pag...
weerstation-woerden.nl Cross Site Scripting vulnerability OBB-1475479
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Django: the behavior of the underlying HTMLParser leading to DoS
An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.striptags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities...
PT-2020-6960 · Reportlab +2 · Reportlab +2
Name of the Vulnerable Software and Affected Versions: reportlab versions prior to the version with the fix Description: The issue is related to Server-side Request Forgery SSRF via img tags. It allows a remote attacker to access confidential data due to insufficient request validation. To reduce...
planmedi.com Cross Site Scripting vulnerability OBB-1446867
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
magnat-nekretnine.co.rs Cross Site Scripting vulnerability OBB-1436863
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
gyogyexpressz.com Cross Site Scripting vulnerability OBB-1435048
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
rebornwelt.de Cross Site Scripting vulnerability OBB-1432972
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
ferretalk.com Cross Site Scripting vulnerability OBB-1431418
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
lookn4u.com Cross Site Scripting vulnerability OBB-1428481
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
invisionalmeria.com Cross Site Scripting vulnerability OBB-1425287
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
diskmoe.com Cross Site Scripting vulnerability OBB-1414911
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
rcpedicoes.com Cross Site Scripting vulnerability OBB-1393782
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Sensitive data exposure in NATS
Preview versions of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials. The connection configuration options in these JavaScript-based implementations were...