CVE-2023-22454 Discourse vulnerable to Cross-site Scripting through pending post titles descriptions

Discourse is an option source discussion platform. Prior to version 2.8.14 on the stable branch and version 3.0.0.beta16 on the beta and tests-passed branches, pending post titles can be used for cross-site scripting attacks. Pending posts can be created by unprivileged users when a category has...

USN-5782-2: Firefox regressions

USN-5782-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Firefox was using an out-of-date libusrsctp library. An attacker could possibly use th...

Stripe: XSS vulnerability without a content security bypass in a `CUSTOM` App through Button tag

A possible XSS vulnerability was discovered in a CUSTOM app through the Button tag, without being able to bypass a content security policy. An attacker could exploit this vulnerability to execute malicious code on the affected website...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from its tag descriptions that can be updated by moderators allowing an attacker to implement cross-sit...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from its pending post titles allowing an attacker to implement cross-site scripting. When a category has...

PT-2023-18511 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 Discourse versions prior to 3.0.0.beta16 Description: The issue affects Discourse, an open-source discussion platform, where tag descriptions can be used for cross-site scripting attacks. This can lead to a...

PT-2023-18510 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 2.8.14 on the stable branch Discourse versions prior to 3.0.0.beta16 on the beta and tests-passed branches Description: The issue concerns a cross-site scripting attack through pending post titles, which can be...

Google Chrome Security Special Issue Vulnerability

Google Chrome is a web browser from Google, an American company. A vulnerability exists in Google Chrome prior to version 91.0.4472.77 due to a security specialization issue that stems from insufficient enforcement of content security policies. An attacker could exploit this vulnerability to bypa...

CVE-2021-30558

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

CVE-2021-30558

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

DEBIAN-CVE-2021-30558

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

Design/Logic Flaw

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

UBUNTU-CVE-2021-30558

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

CVE-2021-30558

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

CVE-2021-30558

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

CVE-2021-30558

Google Chrome prior to 91.0.4472.77 had an insufficient Content Security Policy enforcement vulnerability allowing a remote attacker to bypass CSP via a crafted HTML page. The issue affects Chrome desktop (client-side CSP handling) with a high impact per CVSS metrics, and was addressed in the Chr...

CVE-2021-30558

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

CVE-2021-30558

Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chrome security severity: Medium...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A vulnerability exists in Google Chrome prior to version 91.0.4472.77 due to a security specialization issue that stems from insufficient enforcement of content security policies. An attacker could exploit this vulnerability to bypa...

Stored XSS in resource file uploading

Description The Resources upload feature does not restrict the type of uploaded file. An attacker can upload an html file and the browser still renders it. The CSP is set to default-src 'self' to prevent inline script execution. However, this can be easily bypassed by uploading a .js file then...