DOM Clobbering Gadget found in astro's client-side router that leads to XSS

Summary A DOM Clobbering gadget has been discoverd in Astro's client-side router. It can lead to cross-site scripting XSS in websites enables Astro's client-side routing and has stored attacker-controlled scriptless HTML elements i.e., iframe tags with unsanitized name attributes on the destinati...

CVE-2024-47826

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" show mode, "database.php" show mode or "search.php". It works by providing HTML code in the extended...

CVE-2024-47826 eLabFTW vulnerable to HTML Injection in extended search error message

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" show mode, "database.php" show mode or "search.php". It works by providing HTML code in the extended...

CVE-2024-47826 eLabFTW vulnerable to HTML Injection in extended search error message

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" show mode, "database.php" show mode or "search.php". It works by providing HTML code in the extended...

CVE-2024-47826 eLabFTW vulnerable to HTML Injection in extended search error message

eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject arbitrary HTML tags in the pages: "experiments.php" show mode, "database.php" show mode or "search.php". It works by providing HTML code in the extended...

CVE-2024-47826

CVE-2024-47826 concerns eLabFTW versions prior to 5.1.5. The issue is an HTML injection in pages that show error messages (experiments.php, database.php, search.php) triggered by including HTML in the extended search string. Injected HTML appears inside a red alert box in the error message; execu...

CVE-2024-48119

Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML...

CVE-2024-48119

Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML...

PT-2024-32993 · Vtiger · Vtiger Crm

Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 8.2.0 Description: The issue is related to a HTML Injection vulnerability in the module parameter. This allows authenticated users to inject arbitrary HTML. Recommendations: For Vtiger CRM version 8.2.0, consider restrictin...

CVE-2024-48119

Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML...

CVE-2024-48119

Vtiger CRM v8.2.0 is affected by a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML. The CVSSv3.1 base score is 5.4 (MEDIUM), with Low impact on confidentiality and integrity and no impact on availability. Exploitation details beyond the authenti...

PT-2024-32837 · Elabftw · Elabftw

Name of the Vulnerable Software and Affected Versions: eLabFTW versions prior to 5.1.5 Description: A vulnerability in eLabFTW allows an attacker to inject arbitrary HTML tags in the pages "experiments.php" show mode, "database.php" show mode, or "search.php". This is achieved by providing HTML...

CVE-2024-48119

Vtiger CRM v8.2.0 has a HTML Injection vulnerability in the module parameter. Authenticated users can inject arbitrary HTML...

GitLab 11.6 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-8970)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...

GitLab 12.5 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-9164)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...

FreeBSD : Gitlab -- vulnerabilities (cc1ac01e-86b0-11ef-9369-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the cc1ac01e-86b0-11ef-9369-2cf05da270f3 advisory. Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user...

CVE-2024-48933

LemonLDAP::NG is affected by CVE-2024-48933: an XSS in the login page via username when userControl allows special HTML characters. Affected versions are prior to 2.19.3. Remediation is to upgrade to a fixed release (e.g., 2.19.3+; later advisories mention 2.20.1 as a fix). The issue is a client-...

Gitlab -- vulnerabilities

Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Keys can push changes to an archived repository Guests can disclose project templates GitLab instanc...

CVE-2024-47781

CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user can insert arbitrary HTML that is displayed in the request wiki queue when requesting a wiki. If a wiki creator comes across the XSS...

PT-2024-32813 · Mediawiki · Createwiki

Name of the Vulnerable Software and Affected Versions: CreateWiki affected versions not specified Description: The issue concerns the CreateWiki extension used for requesting and creating wikis, where the name of requested wikis is not properly escaped on the Special:RequestWikiQueue page. This...