#cwe-80

共收录 104 条相关情报。

漏洞预警2026-09-22 发布INFO

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-char...

CVE-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Stat

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

安全公告2026-09-22 发布INFO

Home Assistant: XSS in Statistics Graph Card

CVE-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Stat

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-80

漏洞预警2026-09-15 发布INFO

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's W...

CVE-2026-12751

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML cod

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-09-15 发布INFO

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the rele...

CVE-2026-54503

plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-09-05 发布MEDIUM

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using strip_tags() only. Becau...

CVE-2026-52774

该漏洞位于 YesWiki 的 Bazar 扩展组件中。YesWiki 是一个基于 PHP 的 wiki 系统，Bazar 用于表单/数据管理。在版本 4.6.6 之前，/widget 路由对 GET 参数 id 的值在输出到 HTML 属

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-09-05 发布MEDIUM

YesWiki is a wiki system written in PHP. From version 4.1.0 to before version 4.6.6, YesWiki's archived-revision view reflects the time GET parameter into a hidden HTML input in...

CVE-2026-52773

YesWiki 是一套由 PHP 编写的 wiki 系统。该漏洞存在于其归档修订版本视图中，影响版本为 4.1.0 至 4.6.5（不含 4.6.6），修复版本为 4.6.6。具体问题位于 handlers/page/show.php 文件

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-09-02 发布INFO

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a...

CVE-2026-32773

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generat

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-08-31 发布INFO

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Securit...

CVE-2026-82838

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered wi

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-08-28 发布INFO

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeTyp...

CVE-2026-55696

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.se

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-80

安全公告2026-08-28 发布INFO

PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction

CVE-2026-55696

### Summary Stored cross-site scripting (XSS) in PrivateBin's attachment download link. An anonymous attacker can creat

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-79 #cwe-80 #severity:medium

漏洞预警2026-08-27 发布INFO

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross...

CVE-2026-5218

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Techno

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

安全公告2026-08-23 发布INFO

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown()...

CVE-2026-5389

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializ

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-80 #severity:medium

漏洞预警2026-08-23 发布INFO

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializing attacker-controlled pre content. Attackers can place ...

CVE-2026-5389

justhtml versions before 1.13.0 contain a cross-site scripting vulnerability in the to_markdown() function when serializ

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-08-21 发布INFO

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-c...

CVE-2026-35163

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Comman

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-08-20 发布INFO

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the audio-task annotation guide renderer in cvat-ui/src/audio/c...

CVE-2026-73220

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the au

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-08-19 发布INFO

A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cr...

CVE-2026-20232

A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-08-18 发布INFO

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leafle...

CVE-2026-52854

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to vers

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-80

漏洞预警2026-08-18 发布INFO

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs ...

CVE-2026-54570

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in An

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-08-18 发布INFO

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary...

CVE-2026-75872

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers

历史摘要 · 未重新核验 · NVD

#cve #cwe-80

漏洞预警2026-08-18 发布INFO

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notificati...

CVE-2026-75082

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/r

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-80