Astra Linux – Vulnerability in Jinja2

Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys that contain non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each of these characters would be interpreted as the start of a separate attribute. If an...

Astra Linux – Vulnerability in Consul

The HashiCorp Consul and Consul Enterprise versions up to 1.9.4 had a key-value KV raw mode that was vulnerable to cross-site scripting attacks. This issue was fixed in versions 1.9.5, 1.8.10, and 1.7.14...

Astra Linux – Vulnerability in Firefox, Thunderbird

A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have led to XSS attacks on websites that insecurely serve files without a content-type header. This vulnerabilit...

Astra Linux – Vulnerability in Firefox and Thunderbird

The Enhanced Tracking Protection’s Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS attacks through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames disguised as legitimate content. This...

Astra Linux – Vulnerability in Tomcat9

In Apache Tomcat versions 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64, and 8.5.50 to 8.5.81, the Form authentication example in the sample web application displayed user-provided data without filtering, exposing an XSS vulnerability...

Astra Linux – Vulnerability in nbconvert

The GitHub Security Lab identified sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML, which may lead to cross-site scripting XSS vulnerabilities if...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Firefox

The DOMParser API did not properly process '' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox versions earlier than 86...

Astra Linux – Vulnerability in ruby-loofah

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah = 2.1.0; versions less than 2.19.1 are vulnerable to cross-site scripting due to the image/svg+xml media type in data URIs. This issue has been fixed in version 2.19.1...

Astra Linux – Vulnerability in Pypy, Jython

The documentation XML-RPC server in Python, from versions 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4, has XSS vulnerabilities due to the servertitle field. This issue occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If the setservertitle function ...

Astra Linux – Vulnerability in python-tornado

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the provided “reason” phrase is used unescaped in HTTP headers where it could be used for header injection or in HTML on the default error page where it could be used for XSS attacks. This...

Astra Linux – Vulnerability in WebKit2GTK

Description: A cross-origin issue with iframe elements was addressed by improving the tracking of security origins. This issue is fixed in tvOS 14.6, iOS 14.6, iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, and watchOS 7.5. Processing maliciously crafted web content may lead to cross-site...

Astra Linux – Vulnerability in Jinja2

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, which could potentially lead to Cross-Site Scripting XSS. The Jinja xmlattr filter can be...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

-create-a-vulnerable-Docker-environment-that-is-susceptible-to-CVE-2023-30212

Создание уязвимой Docker-среды, подверженной CVE-2023-30212 Описание Docker-среда и эксплуатация уязвимости CVE-2023-30212. CVE-2023-30212 — это уязвимость безопасности, затрагивающая версии OURPHP до 7.2.0 включительно. Эта уязвимость позволяет осуществлять межсайтовый скриптинг XSS. OURPHP sudo...

cve-2025-0133

Сканер CVE-2025-0133 Сканер уязвимости Reflected XSS в Palo Alto PAN-OS GlobalProtect. Возможности Сканирование одной цели и массовое сканирование Многопоточность настраиваемая Поддержка прокси Burp, ZAP и т.д. Цветной вывод с итогом Сохранение уязвимых URL в файл Установка Через pip из GitHub...

CVE-2026-47761

👋 안녕하세요! 보안 연구 🛡️ CVE-2026-47761 – 보안 연구원 유형 : 저장형 크로스 사이트 스크립팅 XSS 제품 : TinyMCE 참조 : CVE : https://nvd.nist.gov/vuln/detail/CVE-2026-47761 GHSA : https://github.com/tinymce/tinymce/security/advisories/GHSA-vg35-5wq7-3x7w 명예의 전당 CVE-2026-47761...

CVE-2025-68147-OSPOS-Stored-XSS

CVE-2025-68147: Межсайтовый скриптинг XSS с сохранением в OpenSourcePOS...

CVE-2021-46069

CVE-2021-46069 익스플로잇 제목: Vehicle Service Management System - 'Mechanic List' 저장형 크로스 사이트 스크립팅 XSS 익스플로잇 작성자: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 중간 참조: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss...

CVE-2026-90696

A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/productshandler.php of the component Product Management Module. Executing a manipulation of the argument ProductName can lead to cross site...