Django TomSelect incomplete escaping of dangerous characters in widget attributes

Summary User supplied values passed through to certain attributes in form widgets are not fully escaped for potentially dangerous tokens, and in some cases are rendered in browser as valid html tags. Details Attributes passed to the widget such as labelfield containing , and similar tokens are no...

HCL SX security vulnerabilities

HCL SX is an application from HCL India. A security vulnerability exists in HCL SX that stems from not setting security attributes on authorization tokens or session cookies, which could lead to cross-site request forgery attacks...

CVE-2024-13731

The Alert Box Block – Display notice/alerts in the front end. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Alert Box block in all versions up to, and including, 1.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-0845 DesignThemes Core Features <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The DesignThemes Core Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

PT-2025-29069

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 Description: A flaw exists in the f2fs file system within the Linux kernel related to insufficient sanity checks on inode numbers ino and extended attribute inode numbers...

CVE-2025-30342

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly...

CVE-2025-30342

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly...

CVE-2025-30342

An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly...

PT-2025-12394

Name of the Vulnerable Software and Affected Versions OpenSlides versions prior to 4.2.5 Description A cross-site scripting XSS issue was discovered. When submitting descriptions, an editor is shown that allows formatting the submitted text, enabling the insertion of various HTML elements. Althou...

Drupal 10.3.x < 10.3.14 / 10.4.x < 10.4.5 / 11.x < 11.0.13 / 11.1.x < 11.1.5 Drupal Vulnerability (SA-CORE-2025-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 10.3.x prior to 10.3.14, 10.4.x prior to 10.4.5, 11.x prior to 11.0.13, or 11.1.x prior to 11.1.5. It is, therefore, affected by a vulnerability. - Improper Neutralization of Input During Web Page...

DRUPAL-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

DRUPAL-CONTRIB-2025-026

Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity references, files, and images. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the kvmarchpostsetmemoryattributes function in the arch/x86/kvm/mmu/mmu.c module of the Linux operating system is related to insufficient locking of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

OSV-2025-207 Security exception in org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=403330010 Crash type: Security exception Crash state: org.apache.lucene.analysis.tokenattributes.CharTermAttributeImpl.clone org.apache.lucene.analysis.tokenattributes.PackedTokenAttributeImpl.clone...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the updatedajax method of the...

SUSE CVE-2025-24387

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue...

kernel: leds: trigger: Unregister sysfs attributes before calling deactivate()

leds in linux kernel permits calling sysfs attributes show/store functions after deactivate has been called...

CVE-2025-24387

A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an OTRS endpoint from a possible malicious web site, would send the authentication cookie, performing an unwanted read operation. This issue...

CVE-2025-1261

CVE-2025-1261 affects HT Mega – Absolute Addons For Elementor (WordPress) up to version 2.8.2. It is a DOM-Based Stored Cross-Site Scripting vulnerability in the Countdown widget caused by insufficient input sanitization and output escaping on user-supplied attributes. Exploitation requires authe...