PT-2024-23253 · Emacs +7 · Emacs +7

Name of the Vulnerable Software and Affected Versions: Emacs versions prior to 29.3 Description: The issue is related to LaTeX preview being enabled by default for e-mail attachments in Emacs. This could potentially allow attackers to execute remote code. There is no information provided about th...

emacs -- multiple vulnerabilities

GNU Emacs developers report: Emacs 29.3 is an emergency bugfix release intended to fix several security vulnerabilities. Arbitrary Lisp code is no longer evaluated as part of turning on Org mode. This is for security reasons, to avoid evaluating malicious Lisp code. New buffer-local variable...

PT-2024-18366 · WordPress · The Ultimate Gift Cards For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress versions up to, and including, 2.6.6 Description: The issue allows unauthenticated attackers to read...

Mattermost Server 5.34.x < 7.1.9 / 7.2.x < 7.8.4 / 7.9.x < 7.9.3 / 7.10.0 (MMSA-2023-00159)

The version of Mattermost Server installed on the remote host is prior to 7.1.9, 7.8.4, or 7.9.3 / 7.10.0. It is, therefore, affected by a vulnerability as referenced in the MMSA-2023-00159 advisory. - Mattermost fails to normalize UTF confusable characters when determining if a preview should be...

Description of Security Update 5 for Exchange Server 2019: March 12, 2024 (KB5036402)

None None...

BIT-GITLAB-2020-13339

An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted...

BIT-SUITECRM-2020-14208

SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting XSS in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML...

BIT-MATTERMOST-2023-1777

Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message...

BIT-JUPYTERLAB-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the...

BIT-JUPYTER-NOTEBOOK-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the...

BIT-JUPYTER-BASE-NOTEBOOK-2024-22420 Stored cross site scripting in Markdown Preview in JupyterLab

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook and Architecture. This vulnerability depends on user interaction by opening a malicious Markdown file using JupyterLab preview feature. A malicious user can access any data that the...

Cross site scripting

Cross Site Scripting XSS vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components...

CVE-2024-24276

Cross Site Scripting XSS vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components...

Grouptime Teamwire Client Security Vulnerability

Grouptime Teamwire Client is an enterprise messaging client application from Grouptime Germany. A security vulnerability exists in Grouptime Teamwire Client versions v.2.0.1 through v.2.4.0. A remote attacker could exploit the vulnerability to obtain sensitive information via a specially crafted...

The vulnerability of the WYSIWYG editor CKEditor’s preview function allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the WYSIWYG editor CKEditor’s preview function exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...

PT-2024-20334 · Teamwire · Teamwire Windows Desktop Client

Name of the Vulnerable Software and Affected Versions: Teamwire Windows desktop client versions 2.0.1 through 2.4.0 Description: A Cross Site Scripting XSS issue allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username, and group...

CVE-2024-24276

Cross Site Scripting XSS vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components...

CKEditor cross-site scripting vulnerability (CNVD-2024-09867)

CKEditor is an open source, web-based text editor. A cross-site scripting vulnerability exists in CKEditor4, which stems from the presence of a cross-site scripting vulnerability that can be exploited by an attacker to execute JavaScript code by abusing a misconfigured preview function...

CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...