#cwe-83

共收录 27 条相关情报。

漏洞预警2026-10-28 发布MEDIUM

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets...

CVE-2026-112356

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail comp

来源摘录 · NVD

#cve #cwe-79 #cwe-83

漏洞预警2026-10-27 发布HIGH

GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScr...

CVE-2026-112353

GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webma

来源摘录 · NVD

#cve #cwe-79 #cwe-83

漏洞预警2026-10-22 发布HIGH

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.1, `Html::commandButton()` in...

CVE-2026-61791

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile devi

来源摘录 · NVD

#cve #cwe-83

漏洞预警2026-10-09 发布INFO

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url val...

CVE-2026-108260

Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-compone

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83

安全公告2026-10-09 发布INFO

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

CVE-2026-108260

### Summary `` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-83 #severity:high

漏洞预警2026-09-18 发布INFO

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer ...

CVE-2026-91127

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applic

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83

安全公告2026-09-18 发布INFO

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

CVE-2026-91127

### Summary Before 2.3.1, the legacy `.doc` renderer emitted document hyperlink targets after HTML escaping but without

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-83 #severity:high

安全公告2026-09-18 发布INFO

File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer

CVE-2026-91127

File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applic

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-79 #cwe-83

漏洞预警2026-08-18 发布INFO

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflec...

CVE-2026-45118

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or pro

历史摘要 · 未重新核验 · NVD

#cve #cwe-83

漏洞预警2026-08-18 发布INFO

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is retur...

CVE-2026-45733

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bas

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83 #cwe-693

漏洞预警2026-07-31 发布INFO

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javas...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElem

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83

安全公告2026-07-31 发布INFO

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

CVE-2026-58263

### Summary jodit's built-in `clean-html` sanitizer can be bypassed by a MathML/`` carrier that hides a dangerous elemen

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-83 #severity:high

安全公告2026-07-31 发布INFO

Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS

CVE-2026-62324

### Summary jodit's `sanitizeHTMLElement` neutralizes a `javascript:` `href` using a bare `href.trim().indexOf('javascr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-83 #severity:medium

漏洞预警2026-07-27 发布INFO

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is app...

CVE-2026-59727

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, trans

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83 #cwe-116

安全公告2026-07-27 发布INFO

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

CVE-2026-59727

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, trans

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-116 #cwe-79 #cwe-83

安全公告2026-07-20 发布INFO

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

CVE-2026-59727

### Summary When a `transition:persist`, `transition:scope`, or `transition:persist-props` directive is applied to a cl

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-83 #cwe-116 #severity:low

漏洞预警2026-07-09 发布INFO

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the t...

CVE-2026-49276

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any b

历史摘要 · 未重新核验 · NVD

#cve #cwe-83

安全公告2026-07-09 发布INFO

Kirby: Self cross-site scripting (self-XSS) in the writer field

CVE-2026-49276

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any b

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-83

漏洞预警2026-07-01 发布INFO

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypa...

CVE-2026-58263

Jodit Editor is a WYSIWYG editor with written in pure TypeScript file and image editing capabilities. In versions prior

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-83

安全公告2026-06-17 发布INFO

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark...

CVE-2026-48591

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-83 #severity:medium