DRUPAL-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

DRUPAL-CONTRIB-2025-026

Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity references, files, and images. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site...

DRUPAL-CONTRIB-2025-025

This module can be used to render Open API Documentation using the RapiDoc library. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal cor...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions due interaction between unexpected parameter values set for ClusterDeployment.hive.openshift.io/v1 and ClusterSync.hiveinternal.openshift.io/v1alpha1 objects in the Reconcile method i...

CVE-2025-30197

Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...

Drupal RapiDoc OAS Field Formatter module < 1.0.1 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Joseph Zhao pandaski in WordPress Module RapiDoc OAS Field Formatter versions 1.0.1...

Drupal Link field display mode formatter module < 1.6.0 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Daniel Wehner dawehner in WordPress Module Link field display mode formatter versions 1.6.0...

Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

This module adds a formatter for link fields that displays the current entity with another view mode inside the link. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal core has been released bu...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026

Formatter Suite provides a suite of field formatters to help present numbers, dates, times, text, links, entity references, files, and images. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

The vulnerability of the EFI loader in microprogrammed software for SIMATIC IPC devices, SIMATIC PC tablets, and SIMATIC Field PG notebooks allows a perpetrator to influence the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the EFI loader in microprogrammed software for SIMATIC IPC devices, SIMATIC PC tablets, and SIMATIC Field PG notebooks is related to the breach of data protection mechanisms. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and...

CVE-2025-1774 Logs manipulation in BotSense

Incorrect string encoding vulnerability in NASK - PIB BotSense allows injection of an additional field separator character or value in the content of some fields of the generated event. A field with additional field separator characters or values can be included in the "extraData" field.This issu...

CVE-2025-1774

CVE-2025-1774 is a string-encoding vulnerability in NASK - PIB BotSense where an additional field separator character or value can be injected into generated events’ extraData. Affected versions are BotSense before 2.8.0. Root cause: incorrect string encoding that allows extra separators/values t...

WordPress Custom Field List Widget Plugin <= 1.5.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin custom-field-list-widget versions = 1.5.1...

NASK PIB BotSense 安全漏洞

NASK PIB BotSense is a financial sector protection system from NASK. A security vulnerability exists in NASK PIB BotSense versions prior to 2.8.0, which stems from a string encoding error that could result in the injection of additional field separators in some fields of a generated event...

CVE-2025-1888

CVE-2025-1888 affects the Leica Web Viewer component of the Aperio Eslide Manager Application. A reflected XSS vulnerability exists in the memo field used to annotate slides; an authenticated user can trigger execution by injecting malicious JavaScript via the memo hover/tooltip interface, which ...

The id3_field_parse function in field.c in libid3tag 0.15.1b allows remote attackers to cause a denial of service

...

NFC: nci: Add bounds checking in nci_hci_create_pipe()

...

BIT-MYSQL-CLIENT-2023-52968

MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fixfieldsifneeded under mysqlderivedprepare when derived is not yet prepared, leading to a findfieldintable crash...