CVE-2024-47841 Path traversal when loading stylesheets

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9...

CVE-2024-47840 Stored XSS through sidebar in Apex skin

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2...

CVE-2024-47840

CVE-2024-47840: A stored XSS vulnerability in the MediaWiki Apex skin exposes stored scripts via the sidebar. Affected versions are MediaWiki Apex skin 1.39.x before 1.39.9, 1.41.x before 1.41.3, and 1.42.x before 1.42.2. The issue is caused by improper neutralization of input during web page gen...

CVE-2024-47847 Various XSSes found in Cargo

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting XSS.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47846 Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Cross-Site Request Forgery CSRF vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47846

CVE-2024-47846 affects the MediaWiki Cargo extension for MediaWiki 3.6.x prior to 3.6.1. The issue is a Cross‑Site Request Forgery (CSRF) vulnerability in Special:DeleteCargoTable and Special:SwitchCargoTable due to insufficient CSRF protection / origin verification on delete actions. The root ca...

CVE-2024-47846 Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Cross-Site Request Forgery CSRF vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

CVE-2024-47849

CVE-2024-47849 affects the MediaWiki extension Cargo for MediaWiki 3.6.x prior to 3.6.1, caused by improper neutralization in SQL commands leading to SQL Injection. Public sources concur on versions to fix: update Cargo to 3.6.1 or later (Snyk lists 3.7+ as the remediation). Documented impact is ...

CVE-2024-47848

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2...

CVE-2024-47845 CSS sanitizer used incorrectly, and is easily bypassed

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2...

CVE-2024-47845 CSS sanitizer used incorrectly, and is easily bypassed

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2...

firefox: thunderbird: Potential directory upload bypass via clickjacking

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking...

firefox: thunderbird: External protocol handlers could be enumerated via popups

The Mozilla Foundation's Security Advisory: By checking the result of calls to window.open with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.11 security and bug fix update

Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4.14.11 on Red Hat Enterprise Linux 9 from Red Hat Container Registry. Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation...

firefox: thunderbird: Potential directory upload bypass via clickjacking

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the issue as follows: A missing delay in directory upload UI could have made it possible for an attacker to trick a user into granting permission via clickjacking...

firefox: thunderbird: Potential memory corruption during JIT compilation

The Mozilla Foundation's Security Advisory: A potential memory corruption vulnerability could be triggered if an attacker has the ability to trigger an OOM at a specific moment during JIT compilation...

firefox: thunderbird: Compromised content process can bypass site isolation

The Mozilla Foundation's Security Advisory: A compromised content process could allow for the arbitrary loading of cross-origin pages...

firefox: thunderbird: External protocol handlers could be enumerated via popups

The Mozilla Foundation's Security Advisory: By checking the result of calls to window.open with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed...

firefox: thunderbird: Compromised content process can bypass site isolation

The Mozilla Foundation's Security Advisory: A compromised content process could allow for the arbitrary loading of cross-origin pages...

CVE-2024-9399

The Mozilla Foundation's Security Advisory: A website configured to initiate a specially crafted WebTransport session could crash the Firefox process, leading to a denial of service condition...