Threats Tagged 'cwe-116'

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text{} and \mbox{} commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarkup, convertLatexToMathMl, <math-span>, <math-div>, and the default identity MathfieldElement.createHTML, allowing malicious input to run arbitrary JavaScript when rendered. This issue is fixed in version 0.110.0.

diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return (\r) and escape sequences (e.g., OSC, CSI), to pass through unsanitized. An attacker can embed malicious control sequences in filenames, diff metadata, or file content that are rendered directly in the terminal during diff viewing. This can lead to output manipulation, including filename spoofing, terminal screen clearing, and clipboard injection via supported escape sequences. Successful exploitation may mislead users during code review, alter terminal state, or result in unintended command execution through clipboard hijacking. This issue has been fixed in the commit 9c81294

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.

A reflected cross-site scripting (XSS) vulnerability (CWE-79) exists in Loytec LWEB-802 before version 5.0.8. This vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious link with specific parameters. The attack can lead to actions performed with the victim's privileges. The vulnerability has a high severity score of 8.7 (CVSS 4.0). No official patch or remediation guidance is currently provided by the vendor.

A stored cross-site scripting (XSS) vulnerability exists in the OPC XML-DA server statistics of Loytec LIP-ME20xC devices and related products up to version 8.4.16 on LINX-A64. An unauthenticated remote attacker can exploit this by sending a crafted User-Agent header in a POST /da request, leading to arbitrary JavaScript execution in an administrator's browser. This can result in session hijacking, credential theft, or device reconfiguration. The vulnerability has a high severity score of 8.7 and does not currently have an official patch or remediation guidance publicly available.

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for 삃삃 and 섄섄 in the request body would share the same cache. This issue has been fixed in versions 15.5.21 and 16.2.11.

remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when the genql client is bundled and imported.

Twig before version 3.26.0 improperly marks several filters in twig/markdown-extra and twig/cssinliner-extra as safe for all output contexts, including HTML, JavaScript, CSS, and URLs, without proper escaping. This can lead to improper encoding or escaping of output, potentially causing security issues. The vulnerability is fixed in version 3.26.0.

Twig, a PHP template language, has an improper encoding vulnerability in versions prior to 3.26.0. The deprecated spaceless filter is incorrectly registered as safe for HTML, which causes Twig's autoescaping mechanism to fail and emit unescaped attacker-controlled markup when spaceless is applied to untrusted input. This vulnerability is fixed in version 3.26.0.

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.