PT-2018-14391

Name of the Vulnerable Software and Affected Versions Next.js versions 7.0.0 through 7.0.1 Description The issue is related to a cross-site scripting XSS problem. It affects the 404 or 500 / error page. Recommendations For versions 7.0.0 and 7.0.1, update to a version that fixes this issue to...

Session Hijack

The Play Framework is vulnerable to a session magement vulnerablity. It is possible by a 3rd-party to acquire session information for another in-progress request for any application that uses the session in the processing of a 500 error page...

Logging event information is not HTML encoded in 500 error page

The Confluence 500 error page lists logging events generated during the request the produced the 500 error page. The strings rendered from this event are not HTML encoded, leaving open a chance for an attacker to exploit this via XSS. I haven't yet investigated to see whether this is actually...