DLA-4024-1 poco - security update

Bulletin has no description...

CVE-2025-23689

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a...

CVE-2025-23689

CVE-2025-23689 describes a Stored XSS in the Blogger Image Import plugin for Blogger Image Import (WordPress). The issue arises from improper input neutralization during web page generation, enabling stored cross-site scripting. Affected version range is from 2.1 to n/a, per the entry. The CVSS b...

OSV-2025-32 UNKNOWN READ in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=389754841 Crash type: UNKNOWN READ Crash state: std::1::basicstring, std::1::allocatorch Poco::Net::NTLMCredentials::parseChallengeMessage Poco::Net::HTTPNTLMCredentials::createNTLMMessage...

CVE-2025-23689: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Poco Blogger Image Import allows Stored XSS.This issue affects Blogger Image Import: from 2.1 through n/a...

PT-2025-16152 · Git +1 · Poco

Name of the Vulnerable Software and Affected Versions: Poco versions affected versions not specified Description: The software contains a crash issue related to an unknown read error occurring within the Poco::Net::NTLMCredentials::parseChallengeMessage and...

PT-2025-5024 · Unknown · Poco Blogger Image Import

Name of the Vulnerable Software and Affected Versions: Poco Blogger Image Import versions 2.1 through n/a Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This enables potential attacke...

poco:http_message_fuzzer: Crash in std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<ch

Project: https://github.com/pocoproject/poco.git Detailed Report: https://oss-fuzz.com/testcase?key=4684696683872256 Project: poco Fuzzing Engine: libFuzzer Fuzz Target: httpmessagefuzzer Job Type: libfuzzerasanpoco Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x5031000005bf Crash...

UIOMatic injection vulnerability

UIOMatic is a tool by Tim Geyssens personal developer. It automatically generates an integrated crud UI for npoco poco based db tables. An injection vulnerability exists in UIOMatic version 5, which stems from the file /src/UIOMatic/wwwroot/backoffice/resources/uioMaticObject.r that can lead to S...

OSV-2024-1272 Segv on unknown address in std::__1::ios_base::~ios_base

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371292576 Crash type: Segv on unknown address Crash state: std::1::iosbase::iosbase Poco::Net::MultipartReader::nextPart Poco::Net::MailMessage::readMultipart...

PT-2024-40624

Name of the Vulnerable Software and Affected Versions: Poco Net affected versions not specified Description: The issue is related to a crash that occurs due to a segmentation fault on an unknown address. The crash involves the std:: 1::ios base destructor and the...

CVE-2024-10412

A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site scripting. The attack can be launched...

CVE-2024-10412

A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site scripting. The attack can be launched...

CVE-2024-10412

A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site scripting. The attack can be launched...

CVE-2024-10412 Poco-z Guns-Medical File Upload upload cross site scripting

A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site scripting. The attack can be launched...

CVE-2024-10412

Poco-z Guns-Medical 1.0 has a cross-site scripting (XSS) vulnerability in the File Upload component, via the upload function at /mgr/upload. The issue arises from manipulating the picture parameter. A remote attacker could exploit it; exploitation details are not provided in the available documen...

CVE-2024-10412 Poco-z Guns-Medical File Upload upload cross site scripting

A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site scripting. The attack can be launched...

CVE-2024-10412: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Poco-z Guns-Medical 1.0. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site scripting. The attack can be launched...

PT-2024-16256

Name of the Vulnerable Software and Affected Versions Poco-z Guns-Medical version 1.0 Description A vulnerability was found in the function upload of the file /mgr/upload of the component File Upload. The manipulation of the argument picture leads to cross site scripting. The attack can be launch...

OSV-2024-1218 UNKNOWN READ in Poco::UTF16Encoding::queryConvert

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372765426 Crash type: UNKNOWN READ Crash state: Poco::UTF16Encoding::queryConvert Poco::TextConverter::convert Poco::Net::NTLMCredentials::parseChallengeMessage...