Cross-site Scripting (XSS)

ghost is vulnerable to Cross-site Scripting XSS. The vulnerability is due to a lack excerptText sanitization within excerpt.js, allowing an attacker to craft malicious payloads that will be rendered in post summaries...

Cross-site Scripting in Ghost

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...

GHSA-FH38-9FGR-454W Cross-site Scripting in Ghost

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...

ghost-as-middleware (=1.0.0), ghost-blade (=0.1.0) +3 more potentially affected by CVE-2024-23725 via ghost (>=0.11.14 <=1.26.2)

ghost NPM version =0.11.14, =0.1.7, =0.1.10 - persistent-ghost =0.8.2 - sign-alex =1.0.1 Source cves: CVE-2024-23725 Source advisory: OSV:GHSA-FH38-9FGR-454W...

CVE-2024-23725

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...

Cross site scripting

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...

Ghost Security Breach

Ghost CMS is an open source headless content management system CMS written in JavaScript from the Ghost Foundation in Singapore. A security vulnerability exists in Ghost versions prior to 5.76.0. An attacker exploited the vulnerability to perform cross-site scripting attacks...

CVE-2024-23725

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...

CVE-2024-23725

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...

CVE-2024-23725

CVE-2024-23725 affects Ghost prior to 5.76.0. The vulnerability is an XSS in post excerpts processed by excerpt.js, allowing an attacker to craft payloads rendered in post summaries. Public references in connected sources corroborate the XSS in Ghost and point to the fixed version 5.76.0 (release...

CVE-2024-23725

Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries...

PT-2024-20036

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 5.76.0 Description The issue allows for cross-site scripting XSS via a post excerpt in excerpt.js, where an XSS payload can be rendered in post summaries. There have been reports of increased actor activities targeting...

PT-2023-9161 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost versions prior to 5.76.0 Description: The issue is related to the lack of protection of the web page structure, allowing a remote attacker to conduct a cross-site scripting XSS attack by sending a specially crafted malicious SVG file...

VulnCheck KEV: CVE-2023-32235

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js...

java-21-openjdk security and bug fix update

1:21.0.1.0.12-2.0.1 - Add Oracle vendor bug URL 1:21.0.1.0.12-2 - Switch to using portable binaries built on RHEL 7 - Sync the copy of the portable specfile with the RHEL 7 version - Related: RHEL-12997 1:21.0.1.0.12-1 - Update to jdk-21.0.1.0+12 GA - Update release notes to 21.0.1.0+12 - Sync th...

The vulnerability of the Ghost content management system, related to inconsistencies in responses to incoming requests, allows a hacker to disclose confidential information.

The vulnerability of the Ghost content management system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability allows a malicious actor to disclose confidential information through a specially crafted HTTP request...

Rocky Linux 9 : unbound (RLSA-2022:8062)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8062 advisory. - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by...

Rocky Linux 8 : unbound (RLSA-2022:7622)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7622 advisory. - NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the ghost domain names attack. The vulnerability works by...

A malicious user can spam ghost deposits to DoS the LayerZeroEndpoint messaging layer

Lines of code Vulnerability details Impact There can be many deposits that will strain the messaging layer, especially in chains that do not cost much to send a transaction. Proof of Concept The entry point of the bridge is callOutSignedAndBridge in BranchBridgeAgent.sol. This function will pack...

Hackers Can Exploit Windows Container Isolation Framework to Bypass Endpoint Security

New findings show that malicious actors could leverage a sneaky malware detection evasion technique and bypass endpoint security solutions by manipulating the Windows Container Isolation Framework. The findings were presented by Deep Instinct security researcher Daniel Avinoam at the DEF CON...