Mageia: Security Advisory (MGASA-2024-0395)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated thunderbird packages fix security vulnerability

Matrix-js-sdk has insufficient MXC URI validation which could allow client-side path traversal. CVE-2024-50336...

Oqtane Framework Incorrect Access Control vulnerability

Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control. By manipulating the entityid parameter, attackers can bypass passcode validation and successfully log into the application or access restricted data without proper authorization. The lack of server-side validation exacerbates the...

Mattermost Server 9.5.x < 9.5.13, 9.11.x < 9.11.5, 10.0.x < 10.0.3, 10.1.x < 10.1.3, 10.2.0 (MMSA-2024-00388, MMSA-2024-00392)

The version of Mattermost Server installed on the remote host is prior to 9.5.13, 9.11.5, 10.0.3, 10.1.3 or 10.2.0. It is, therefore, affected by the vulnerabilities as referenced in the MMSA-2024-00388 and MMSA-2024-00392 advisories: - Mattermost fails to prevent concurrently checking and updati...

asyncssh SSH Man-in-the-Middle

The vulnerability of the client-side and server-side implementations of the SSHv2 asyncssh protocol in Python lies in insufficient validation of data authenticity. Exploiting this vulnerability allows a malicious actor to carry out “man-in-the-middle” attacks remotely...

asyncssh SSH Man-in-the-Middle

The vulnerability of the client-side and server-side implementations of the SSHv2 asyncssh protocol in Python lies in the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to perform “man-in-the-middle” attacks remotely...

CVE-2024-56175

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names...

CVE-2024-56174

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history...

CVE-2024-56175

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names...

CVE-2024-56175

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names...

CVE-2024-56174: Improper Neutralization of Input During Web Page Generation

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history...

CVE-2024-56174

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history...

CVE-2024-56174

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history...

CVE-2024-56174

In Optimizely Configured Commerce versions prior to 5.2.2408 , a stored cross-site scripting (XSS) vulnerability exists due to client-side template injection in the search history. This flaw allows malicious payloads to be stored and subsequently executed within users' browsers under specific con...

CVE-2024-56175

Optimizely Configured Commerce versions prior to 5.2.2408 are vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is a client-side template injection occurring in list item names , which allows an attacker to store malicious payloads that execute in other users' browsers unde...

CVE-2024-56175: Improper Neutralization of Input During Web Page Generation

In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in list item names...

PT-2024-36732 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: The issue allows malicious payloads to be stored and executed in users' browsers under specific conditions due to a client-side template injection in list item names,...

HTML Injection

Directus is vulnerable to HTML Injection. The vulnerability is due to the filtering of restricted characters, such as HTML tags, being implemented on the client-side, which can be bypassed. It allowing an attacker to inject malicious HTML content...

www/varnish7 -- client-side desync vulnerability

The Varnish Development Team reports: A client-side desync vulnerability can be triggered in Varnish Cache and Varnish Enterprise. This vulnerability can be triggered under specific circumstances involving malformed HTTP/1 requests...

Mattermost Improper Validation of Specified Type of Input vulnerability

Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side webapp and mobile DoS to users of particular channels, by sending a specially crafted post...