CVE-2021-37634

Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting XSS attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an...

CVE-2021-37634

Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting XSS attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an...

Cross site scripting

Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest...

CVE-2021-37633

Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest...

Cross site scripting

Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting XSS attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an...

CVE-2021-37634 LeafKit allows XSS with untrusted user input

Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting XSS attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an...

CVE-2021-37634

LeafKit (Leaf kit) prior to v1.3.0 is vulnerable to Cross-site Scripting (XSS) when unsanitised data is passed to variable tags due to lack of escaping. The issue stems from not escaping strings rendered as variables, allowing injected scripts into generated Leaf pages if mitigations like a CSP a...

CVE-2021-37633 XSS via d-popover and d-html-popover attribute

Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest...

PT-2021-21748 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.7.8 Description: The issue affects Discourse, an open source discussion platform, where rendering of d-popover tooltips can be susceptible to XSS attacks in versions prior to 2.7.8. This vulnerability only affect...

PT-2021-21749 · Leafkit · Leafkit

Name of the Vulnerable Software and Affected Versions: Leafkit versions prior to 1.3.0 Description: Leafkit is a templating language with Swift-inspired syntax. The issue affects anyone passing unsanitised data to Leaf's variable tags. Before the fix, Leaf would not escape any strings passed to...

CVE-2021-37540

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

CVE-2021-37540

In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...

PT-2021-21699 · Jetbrains · Jetbrains Hub

Name of the Vulnerable Software and Affected Versions: JetBrains Hub versions prior to 2021.1.13262 Description: The issue is related to a potentially insufficient Content Security Policy CSP used in the Widget deployment feature. This could lead to security risks, although specific details about...

JetBrains Hub 加密问题漏洞

JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is capable of integrating multiple JetBrains team tools together. An encryption issue vulnerability exists in versions prior to JetBrains Hub 2021.1.13262, which stems from the fact that the CSP used by the...

What’s New in InsightAppSec and tCell: Q2 2021 in Review

If there’s a theme to InsightAppSec and tCell updates and improvements in the second quarter, it would be “save time by building it into the process.” Building a more efficient process is key in further securing web applications. Can you get it done faster from home? Or is the quickest way to the...

Security update for fossil (moderate)

openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2021:1050-1 Rating: moderate References: 1187988 Affected Products: openSUSE Backports SLE-15-SP3 An update that contains security fixes can now be installed. Description: This update for fossil fixes the following...

Security update for fossil (moderate)

openSUSE Security Update: Security update for fossil Announcement ID: openSUSE-SU-2021:1052-1 Rating: moderate References: 1187988 Affected Products: openSUSE Backports SLE-15-SP1 An update that contains security fixes can now be installed. Description: This update for fossil fixes the following...

CVE-2021-32764

Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is...

CVE-2021-32764

Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is...

CVE-2021-32764

Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior, parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is...