GHSA-C2XF-9V2R-R2RX Hugo does not escape some attributes in internal templates

Impact Some HTML attributes in Markdown in the internal templates listed below not escaped. Impacted are Hugo users who do not trust their Markdown content files and are using one or more of these templates. default/markup/render-link.html from v0.123.0 default/markup/render-image.html from...

Hugo cross-site scripting vulnerabilities

Hugo is a Go-based framework for rapid static site generation from the Gohugoio community. A cross-site scripting vulnerability exists in Hugo versions prior to 0.123.0 through 0.139.4, which stems from improperly escaping HTML attributes in certain Markdown in internal rendering hooks...

CVE-2024-55601: Improper Neutralization of Input During Web Page Generation

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are usin...

PT-2024-36563

Name of the Vulnerable Software and Affected Versions Hugo versions 0.123.0 through 0.139.4 Description The issue concerns unescaped HTML attributes in Markdown within internal templates. This affects Hugo users who do not trust their Markdown content files and are using one or more of the...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2024-52804 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2024-52804 Source advisory: OSV:GHSA-8W49-H785-MJ3C...

CVE-2024-34155 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller-fips, gomplate, prometheus-beat-exporter, redka, sops, loki-fips, kube-bench, opentelemetry-collector-contrib-fips, harbor-scanner-trivy, helm-operator-fips, amass, prometheus-alertmanager, opentelemetry-collector-contrib, nri-f5,...

CVE-2024-24791 vulnerabilities

Vulnerabilities for packages: gomplate, prometheus-beat-exporter, redka, kube-bench, harbor-scanner-trivy, helm-operator-fips, amass, prometheus-alertmanager, opentelemetry-collector-contrib, nri-f5, rabbitmq-cluster-operator, configmap-reload, temporal-ui-server, up, cortex-fips, gosu,...

CVE-2024-24792 vulnerabilities

Vulnerabilities for packages: gotenberg, hugo-extended, hugo, ollama, chainctl...

CVE-2024-24792 vulnerabilities

Vulnerabilities for packages: ollama, hugo-extended, hugo...

GHSA-9PHM-FM57-RHG8 vulnerabilities

Vulnerabilities for packages: gotenberg, hugo-extended, hugo, ollama, chainctl...

Malicious code in hugo-cloudflare-docs (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2492 Malicious code in hugo-cloudflare-docs (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: flux, sops, terragrunt, zarf, guac, argo-workflows, nuclei, argo-events, thanos, cosign, fulcio, wal-g, grafana-agent-operator, policy-controller, hugo, airflow, k8sgpt, timestamp-authority, velero, prometheus-operator, harbor-registry, py3-cassandra-medusa,...

hugo-jupyter (>=0.2.1, <=0.3.0), kitehistory (1.4.0) +2 more potentially affected by CVE-2024-14029 via tornado (4.5.1)

tornado PYPI version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - hugo-jupyter =0.2.1, =0.3.1, =1.5.1 Source cves: CVE-2024-14029 Source advisory: OSV:GHSA-753J-MPMX-QQ6G...

GO-2024-2747 Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo

Hugo Markdown titles are not escaped in internal render hooks in github.com/gohugoio/hugo...

CVE-2024-33686

Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea...

CVE-2024-33686

CVE-2024-33686 is a Missing Authorization vulnerability affecting multiple Extend Themes products (Pathway until 1.0.15; Hugo WP until 1.0.8; Althea WP until 1.0.13; Elevate WP until 1.0.15; Brite until 1.0.11; Colibri WP until 1.0.94; Vertice until 1.0.7). The CVE has a CVSSv3.1 base score of 4....

CVE-2024-33686: Missing Authorization

Missing Authorization vulnerability in Extend Themes Pathway, Extend Themes Hugo WP, Extend Themes Althea WP, Extend Themes Elevate WP, Extend Themes Brite, Extend Themes Colibri WP, Extend Themes Vertice.This issue affects Pathway: from n/a through 1.0.15; Hugo WP: from n/a through 1.0.8; Althea...

PT-2024-25441 · Extend Themes · Extend Themes Colibri Wp +6

Name of the Vulnerable Software and Affected Versions: Extend Themes Pathway versions 1.0.15 and earlier Extend Themes Hugo WP versions 1.0.8 and earlier Extend Themes Althea WP versions 1.0.13 and earlier Extend Themes Elevate WP versions 1.0.15 and earlier Extend Themes Brite versions 1.0.11 an...

WordPress Hugo WP theme <= 1.0.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme Hugo WP versions = 1.0.8...