CveMateVulnerability intelligence

W3C vulnerabilities

12 vulnerabilities

Known vulnerabilities in W3C products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 8 products.

Products

8

Jigsaw3 vulnerabilities
Amaya Web Browser2 vulnerabilities
Cern Httpd2 vulnerabilities
Css Validator2 vulnerabilities
Amaya1 vulnerabilities
Online Spellchecker Py1 vulnerabilities
Unicorn1 vulnerabilities
Libwww0 vulnerabilities

CVE-2021-4296w3unicorn+13y ago29-12-2022 08:52

A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of the file src/org/w3c/unicorn/response/impl/ValidatorNuMessage.java. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 51f75c31f7fc33859a9a571311c67ae4e95d9c68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217019.CVE-2025-1781w3css_validator+11y ago28-03-2025 13:48

There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to read arbitrary local files if an attacker has access to exception messages.CVE-2020-4070w3ccss_validator+16y ago22-06-2020 15:40

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9.CVE-2014-125108w3spell_checker+12y ago23-12-2023 16:31

A vulnerability was found in w3c online-spellchecker-py up to 20140130. It has been rated as problematic. This issue affects some unknown processing of the file spellchecker. The manipulation leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is d6c21fd8187c5db2a50425ff80694149e75d722e. It is recommended to apply a patch to fix this issue. The identifier VDB-248849 was assigned to this vulnerability.CVE-2008-5282w3camaya_web_browser17y ago29-11-2008 02:00

Multiple stack-based buffer overflows in W3C Amaya Web Browser 10.0.1 allow remote attackers to execute arbitrary code via (1) a link with a long HREF attribute, and (2) a DIV tag with a long id attribute.CVE-2008-6005w3camaya_web_browser17y ago28-01-2009 20:00

Multiple buffer overflows in the CheckUniqueName function in W3C Amaya Web Browser 10.0.1, and possibly other versions including 11.0.1, might allow remote attackers to execute arbitrary code via "duplicated" attribute value inputs.CVE-2000-0079w3ccern_httpd26y ago04-02-2000 05:00

The W3C CERN httpd HTTP server allows remote attackers to determine the real pathnames of some commands via a request for a nonexistent URL.CVE-2004-2274w3cjigsaw21y ago19-07-2005 04:00

Unknown vulnerability in Jigsaw before 2.2.4 has unknown impact and attack vectors, possibly related to the parsing of the URI.CVE-2002-1052w3cjigsaw24y ago31-08-2002 04:00

Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to (1) cause a denial of service using the "con" device, or (2) obtain the physical path of the server using two requests to the "aux" device.CVE-2002-1053w3cjigsaw23y ago02-04-2003 05:00

Cross-site scripting (XSS) vulnerability in W3C Jigsaw Proxy Server before 2.2.1 allows remote attackers to execute arbitrary script via a URL that contains a reference to a nonexistent host followed by the script, which is included in the resulting error message.CVE-2002-1445w3ccern_httpd23y ago18-03-2003 05:00

Cross-site scripting (XSS) vulnerability in CERN Proxy Server allows remote attackers to execute script as other users via a link to a non-existent page whose name contains the script, which is inserted into the resulting error page.CVE-2006-1900w3camaya20y ago20-04-2006 10:00

Multiple buffer overflows in World Wide Web Consortium (W3C) Amaya 9.4, and possibly other versions including 8.x before 8.8.5, allow remote attackers to execute arbitrary code via a long value in (1) the COMPACT attribute of the COLGROUP element, (2) the ROWS attribute of the TEXTAREA element, and (3) the COLOR attribute of the LEGEND element; and via other unspecified attack vectors consisting of "dozens of possible snippets."