29 matches found
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-50105
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
CVE-2026-50105
The CVE-2026-50105 entry concerns Gitea: RSS/Atom feed handlers bypass API-token scope and public‑only confinement (an incomplete fix of #37698). Public sources in the connected documents describe a access-control weakness in the feed handling component that can bypass token scope checks, enablin...
CVE-2026-50105 RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698...
GHSA-6CQF-375W-639G Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
Summary Gitea's RSS/Atom feed handlers accept API-token Basic auth but perform no token-scope or public-only enforcement. A personal access token that is correctly blocked HTTP 403 from a private repository on /raw, /media, /archive, and /releases/download/... — because it is marked public-only o...
Linux Distros Unpatched Vulnerability : CVE-2017-12980
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that us...
[SECURITY] Fedora 34 Update: newsboat-2.24-1.fc34
Newsboat is a fork of Newsbeuter, an RSS/Atom feed reader for the text consol e...
Fedora: Security Advisory for newsboat (FEDORA-2021-79ce3cb64a)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
USN-4585-1: Newsbeuter vulnerabilities
It was discovered that Newsbeuter didn't handle the command line input properly. An remote attacker could use it to ran remote code by crafting a special input file. CVE-2017-12904 It was discovered that Newsbeuter didn't handle metacharacters in its filename properly. An remote attacker could us...
Mail.ru: XXE on pulse.mail.ru
XML External Entity injection XXE in RSS/Atom feed parsing code in pulse.mail.ru allowed access to local files. All Mail.Ru projects are covered by extended scope bug bounty program...
mybb -- vulnerabilities
mybb Team reports: High risk: Image MyCode “alt” attribute persistent XSS. Medium risk: RSS Atom 1.0 item title persistent XSS...
Newsbeuter: User-assisted execution of arbitrary code
Background Newsbeuter is a RSS/Atom feed reader for the text console. Description Newsbeuter does not properly escape shell meta-characters in an RSS item with a media enclosure in the podcast playback function of Podbeuter. Impact A remote attacker, by enticing a user to open a feed with a...
CVE-2017-12980
DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed, in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field, as...
Simplog 0.9.3.2 - Mutliple Vulnerabilities
No description provided by source. Mutliple Vulnerabilities in Simplog v0.9.3.2 Name Multiple vulnerabilities in Simplog Systems Affected Simplog 0.9.3.2 and possibly earlier versions Download http://sourceforge.net/projects/simplog/files/simplog/0.9.3.2/simplog-0.9.3.2.tar.gz/download Author Amo...
JVN#18397171: FeedDemon vulnerable to arbitrary script execution
FeedDemon is an RSS/Atom feed reader. FeedDemon is vulnerable to arbitrary script execution due to the improper processing during HTML page output based on feed information when using the "feed preview" option. Impact An arbitrary script embedded in an RSS/Atom feed may be executed on the user's...
CVE-2011-3999
Cross-site scripting XSS vulnerability in the RSS/Atom feed-reader implementation in Iwate Portal Bar allows remote attackers to inject arbitrary web script or HTML via a crafted feed...
