January 28, 2025—KB5050081 (OS Build 19045.5440) Preview

None None...

CVE-2024-11913

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajaxpreviewlink' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web...

SUSE SLES15: kubevirt-container-disk / kubevirt-manifests / etc (SUSE-SU-2025:0215-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:0215-1 advisory. Update to version 1.4.0 - Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.4.0 - Enable aarch64 build for SL...

DRUPAL-CONTRIB-2025-004

The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes. The module doesn't sufficiently check for access to view the preview listing of the logs. Full log details are correctly protected, and API keys are never logged. This vulnerability is...

SUSE-SU-2025:0217-1 Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.61.0: Release notes -...

XSS/HTML Injection Vulnerability in Umbraco Preview Badge

Impact Authenticated users are able to exploit an XSS vulnerability when viewing previewed content. Patches Will be patched in 10.8.8, 13.5.3, 14.3.2 and 15.1.2. Workarounds None available...

Cross-site Scripting (XSS)

Overview Umbraco.Cms.Web.Common is a package containing the web assembly needed to run Umbraco CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS when viewing previewed content. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker...

GHSA-69CG-W8VM-H229 XSS/HTML Injection Vulnerability in Umbraco Preview Badge

Impact Authenticated users are able to exploit an XSS vulnerability when viewing previewed content. Patches Will be patched in 10.8.8, 13.5.3, 14.3.2 and 15.1.2. Workarounds None available...

Malicious code in design-preview (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffc37b5b24f991c9971b396f89d6033730450e10bb121b33c1bbe183d4a636a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-292 Malicious code in design-preview (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffc37b5b24f991c9971b396f89d6033730450e10bb121b33c1bbe183d4a636a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-42556

Name of the Vulnerable Software and Affected Versions mediawiki affected versions not specified Description The software contains a flaw that allows an attacker to escape three system messages used by live preview. This could potentially lead to unauthorized actions or information disclosure...

Directory Traversal

Overview changedetection.io is a Website change detection and monitoring service Affected versions of this package are vulnerable to Directory Traversal on URLs received as input. An attacker can read local files via the watch preview functionality. URLs are not sufficiently checked for paths tha...

CVE-2024-53276 GHSL-2024-092: Open CORS policy in home-gallery

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, an open CORS policy in app.js may allow an attacker to view the images of home-gallery when it is using the default settings. The following express middleware allows any website ...

CVE-2024-56358 Cross-site Scripting vulnerability through svg attachment previews in grist-core

grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are...

PT-2024-36800 · Unknown · Grist-Core

Name of the Vulnerable Software and Affected Versions: grist-core versions prior to 1.3.2 Description: The issue concerns a spreadsheet hosting server where a user's account could be compromised by visiting a malicious document and previewing an attachment. This happens because JavaScript in an S...

Grist 跨站脚本漏洞

Grist is a modern relational spreadsheet open-sourced by Grist. A cross-site scripting vulnerability exists in Grist versions prior to 1.3.2, which stems from a JavaScript in an SVG file that can be executed in the context of the user's current page, thereby compromising the account of a user who...

CVE-2023-47830

Missing Authorization vulnerability in Addons for Contact Form 7 Live Preview for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Preview for Contact Form 7: from n/a through 1.2.0...

CVE-2023-47830 WordPress Live Preview for Contact Form 7 plugin <= 1.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in GusRuss89 Live Preview for Contact Form 7 cf7-live-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Preview for Contact Form 7: from n/a through = 1.2.0...

CVE-2023-47830 WordPress Live Preview for Contact Form 7 plugin <= 1.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Addons for Contact Form 7 Live Preview for Contact Form 7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Preview for Contact Form 7: from n/a through 1.2.0...

PT-2024-13507 · WordPress · Live Preview For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Live Preview for Contact Form 7 versions 1.2.0 and earlier Description: The issue is related to a Missing Authorization vulnerability in Addons for Contact Form 7 Live Preview for Contact Form 7. This vulnerability allows exploiting incorrect...