EUVD-2021-10851

Malware in sbrugna...

CVE-2018-14776: Improper Neutralization of Input During Web Page Generation

Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document...

PT-2018-12715

Name of the Vulnerable Software and Affected Versions Passwordstate versions prior to 8.3 Build 8397 Description The issue allows cross-site scripting XSS by authenticated users through an uploaded HTML document. Recommendations For versions prior to 8.3 Build 8397, update to version 8.3 Build 83...

Content-Disposition: attachment ignored if Content-Type: multipart also present

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting XSS...