Priority HIGH 76
There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF).
w3c
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
w3c records in CISA KEVNo w3c vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
14 records
TI-2008-05027 CVE-2008-5282 · GHSA-qq75-75c9-p3pm
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote…
Priority MEDIUM 60
Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a long HREF attribute, and (2) a DIV tag with a long id attribute.
TI-2008-05701 CVE-2008-6005 · GHSA-pp86-pm93-fc5h
Multiple buffer overflows in the CheckUniqueName function in W3C Amaya Web Browser…
Priority MEDIUM 50
Multiple buffer overflows in the CheckUniqueName function in W3C Amaya Web Browser 10.0.1, and possibly other versions including 11.0.1, might allow remote attackers to execute arbitrary code via "duplicated" attribute v…
TI-2006-01845 CVE-2006-1900 · GHSA-gg2r-jxgr-8f34
Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly…
Priority MEDIUM 50
Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribu…
TI-2000-00079 CVE-2000-0079 · GHSA-wcrp-rm6p-5mqx
The W3C CERN httpd HTTP server allows remote attackers to determine the real pathnames of…
Priority LOW 37
The W3C CERN httpd HTTP server allows remote attackers to determine the real pathnames of some commands via a request for a nonexistent URL.
TI-2002-01025 CVE-2002-1053 · GHSA-6g3c-9q4h-j586
Cross-site scripting (XSS) vulnerability in W3C Jigsaw Proxy Server before 2.2.1 allows…
Priority LOW 34
Cross-site scripting (XSS) vulnerability in W3C Jigsaw Proxy Server before 2.2.1 allows remote attackers to execute arbitrary script via a URL that contains a reference to a nonexistent host followed by the script, which…
TI-2004-02146 CVE-2004-2274 · GHSA-xmpv-7jqr-6j8j
Unknown vulnerability in Jigsaw before 2.2.4 has unknown impact and attack vectors…
Priority LOW 31
Unknown vulnerability in Jigsaw before 2.2.4 has unknown impact and attack vectors, possibly related to the parsing of the URI.
TI-2021-03154 CVE-2021-4296 · GHSA-9cgm-gf5x-jx5x
w3c Unicorn ValidatorNuMessage.java ValidatorNuMessage cross site scripting
Priority LOW 28
A vulnerability, which was classified as problematic, has been found in w3c Unicorn.
TI-2014-08408 CVE-2014-125108 · GHSA-5868-pcx8-r4mq
w3c online-spellchecker-py spellchecker cross site scripting
Priority LOW 28
A vulnerability was found in w3c online-spellchecker-py up to 20140130.
TI-2002-01024 CVE-2002-1052 · GHSA-hgwf-x3rj-c9m5
Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in…
Priority LOW 28
Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to (1) cause a denial of service using the "con" device, or (2) obtain the physical path of the server using two request…
TI-2002-01367 CVE-2002-1445 · GHSA-hf5w-p8q3-x6vf
Cross-site scripting (XSS) vulnerability in CERN Proxy Server allows remote attackers to…
Priority LOW 27
Cross-site scripting (XSS) vulnerability in CERN Proxy Server allows remote attackers to execute script as other users via a link to a non-existent page whose name contains the script, which is inserted into the resultin…
Priority LOW 25
WebSub is a W3C recommendation produced by the Social Web Working Group.
TI-2020-03551 CVE-2020-4070
Cross-site Scripting in CSS Validator
Priority LOW 25
In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs.
TI-2005-03010 CVE-2005-3183 · GHSA-q27h-3894-69mg
The HTBoundary_put_block function in HTBound.c for W3C libwww (w3c-libwww) allows remote…
Priority LOW 24
The HTBoundary_put_block function in HTBound.c for W3C libwww (w3c-libwww) allows remote servers to cause a denial of service (segmentation fault) via a crafted multipart/byteranges MIME message that triggers an out-of-b…