[SECURITY] Fedora 39 Update: rust-leb128-0.2.5-9.fc39

Read and write DWARF's "Little Endian Base 128" LEB128 variable length integer encoding...

GHSA-VVH5-7V3M-J3MJ Moodle Unsanitized HTML in site log for config_log_created

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered...

CVE-2024-34006

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered...

UBUNTU-CVE-2024-34006

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered...

CVE-2024-34006

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered...

CVE-2024-34006 moodle: unsanitized HTML in site log for config_log_created

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered...

CVE-2024-34006 moodle: unsanitized HTML in site log for config_log_created

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered...

CVE-2024-34006 moodle: unsanitized HTML in site log for config_log_created

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered...

PT-2024-25634 · Alt Linux +1 · Alt Linux +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns the site log report, which required additional encoding of event descriptions. This encoding is necessary to ensure that any HTML in the content is displayed in...

PT-2024-4606

Name of the Vulnerable Software and Affected Versions: OpenTelemetry Collector versions prior to 0.102.1 confighttp module versions prior to 0.102.0 configgrpc module versions prior to 0.102.1 Description: An unsafe decompression vulnerability allows unauthenticated attackers to crash the collect...

TYPO3 Cross-Site Scripting in Frontend User Login

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile. Template...

GHSA-WG8H-GXF4-G4GH TYPO3 Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

CVE-2024-3584

CVE-2024-3584 affects qdrant/qdrant (version 1.9.0-dev) and is caused by improper input validation in the /collections/{name}/snapshots/upload endpoint, enabling path traversal via URL-encoded name to write/overwrite arbitrary files (e.g., /root/poc.txt). The vulnerability can lead to full system...

CVE-2024-3584 Path Traversal in qdrant/qdrant

qdrant/qdrant version 1.9.0-dev is vulnerable to path traversal due to improper input validation in the /collections/name/snapshots/upload endpoint. By manipulating the name parameter through URL encoding, an attacker can upload a file to an arbitrary location on the system, such as /root/poc.txt...

PT-2024-40498 · Unknown · Online Media Asset Rendering

Name of the Vulnerable Software and Affected Versions: Online media asset rendering affected versions not specified Description: The issue arises from the failure to properly encode user input, making online media asset rendering vulnerable to cross-site scripting, particularly for .youtube and...

PT-2024-40060 · Form · Form

Name of the Vulnerable Software and Affected Versions: form affected versions not specified Description: The issue arises from the improper encoding of user input in frontend forms handled by the form framework, leading to cross-site scripting. Recommendations: At the moment, there is no...

SAP NetWeaver Application Server Cross-Site Scripting Vulnerability (CNVD-2024-35657)

SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server ABAP Platform, which stems from a lack of input validation and output encoding of untrusted data, and can be exploited by an unauthenticated...

Medium: golist

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

PT-2024-40003 · Fluid · Fluid

Name of the Vulnerable Software and Affected Versions: Fluid affected versions not specified Description: The issue arises from the failure to properly encode user input in templates that utilize built-in Fluid ViewHelpers, making them susceptible to cross-site scripting. Recommendations: At the...

PT-2024-40148 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue arises from the failure to properly encode information from external sources. Specifically, the language pack handling in the install tool is susceptible to cross-site...