CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

PT-2024-20580 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.59.0 Frappe versions prior to 15.5.0 Description: Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. The issue is related ...

PT-2024-1609 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 121.0.6167.160 Description: The issue is related to a use after free in Mojo, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could lead to arbitrary code...

Design/Logic Flaw

The Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the seedprodlitenewlpage function in all versions up to, and including, 6.15.21...

Authentication flaw

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page...

SlimStat Analytics < 5.1.4 - Subscriber+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the 'filterarray' parameter due to insufficient input sanitization and output escaping, allowing any authenticated users, such as subscriber, to inject arbitrary web scripts in pages that will execute whenever a user accesses...

CVE-2024-21794 Open Redirect in Rapid SCADA

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page...

UBUNTU-CVE-2024-23645

GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12...

CVE-2024-23645 GLPI reflected XSS in reports pages

GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12...

CVE-2023-51677

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.23...

PT-2024-19996 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.12 Description: A malicious URL can be used to execute XSS on reports pages. This issue affects GLPI, a Free Asset and IT Management Software package. Recommendations: For versions prior to 10.0.12, upgrade to...

GLPI -- multiple vulnerabilities

GLPI team reports: GLPI 10.0.12 Changelog SECURITY - moderate Reflected XSS in reports pages CVE-2024-23645 SECURITY - moderate LDAP Injection during authentication CVE-2023-51446...

PT-2024-14235 · Unknown · Magazine3 Schema & Structured Data For Wp & Amp

Name of the Vulnerable Software and Affected Versions: Magazine3 Schema & Structured Data for WP & AMP versions 1.23 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means an attack...

Cross Site Scripting (XSS)

@tanstack/react-query-next-experimental is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper handling of the id variable within the createHydrationStreamProvider method, which allows an attacker to inject arbitrary JavaScript when react-query-next-experimental preforms...

Cross Site Scripting (XSS)

@apollo/experimental-nextjs-app-support is vulnerable to Cross Site Scripting XSS. The vulnerability due to improper sanitization during server-side rendering of HTML pages, which allows an attacker to perform XSS...

@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

Impact The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this...

GHSA-997G-27X8-43RF react-query-streamed-hydration Cross-site Scripting vulnerability

Impact The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or arrange to have malicious input be returned from an endpoint. This vulnerability arises from improper...

kernel: x86/sev: Make enc_dec_hypercall() accept a size instead of npages

In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make encdechypercall accept a size instead of npages encdechypercall accepted a page count instead of a size, which forced its callers to round up. As a result, non-page aligned vaddrs caused pages to be spuriously marke...

Important: Red Hat Security Advisory: tomcat security update

An update for tomcat is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2024-0841

A null pointer dereference flaw was found in the hugetlbfsfillsuper function in the Linux kernel hugetlbfs HugeTLB pages functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system...