55 matches found
GHSA-XGPM-Q3MQ-46RQ PrestaShop some attribute not escaped in Validate::isCleanHTML method
Description Some event attributes are not detected by the isCleanHTML method Impact Some modules using the isCleanHTML method could be vulnerable to xss Patches 8.1.3, 1.7.8.11 Workarounds The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library...
PrestaShop some attribute not escaped in Validate::isCleanHTML method
Description Some event attributes are not detected by the isCleanHTML method Impact Some modules using the isCleanHTML method could be vulnerable to xss Patches 8.1.3, 1.7.8.11 Workarounds The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library...
UBUNTU-CVE-2023-2233
An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak the owner's Sentry instance projects...
CVE-2023-41336: symfony/ux-autocomplete Prevent injection of invalid entity ids for "autocomplete" fields
Affected Versions Versions 2.11.1 are of the symfony/ux-autocomplete package are affected by this security issue. Description Under certain circumstances, an attacker could successfully submit an entity id for an EntityType that is not part of the valid choices. Affected applications are any that...
Brocade Product Security Incident Response Team Contact Information
Brocade Communications Systems Brocade is committed to resolving vulnerabilities to meet the needs of its customers and the broader technology community. Brocade Product Security Incident Response Team Brocade PSIRT is a global team that manages the receipt, investigation and internal coordinatio...
MAL-2022-4655 Malicious code in mocha-junit-reporters-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36310669cb81042359b5d17259bddbe5ae2c47e98223446020c5be918f3b39e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in mocha-junit-reporters-2
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in mocha-junit-reporters-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36310669cb81042359b5d17259bddbe5ae2c47e98223446020c5be918f3b39e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Stripe: CSRF token validation system is disabled on Stripe Dashboard
@dsharad discovered that due to a code change deployed on 2/14/2022, Cross Site Request Forgery CSRF protection was disabled in the Stripe Dashboard. This could have allowed an attacker to trick a victim user to visit a malicious website and cause limited changes to the victim’s Stripe account su...
NSO Group Spyware Targeted Dozens of Reporters in El Salvador
The newly disclosed campaign shows how little the company has done to curb abuses of its powerful surveillance tools...
Mozilla: Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4
The Mozilla Foundation Security Advisory describes this flaw as: Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Thunderbird 91.3. Some of these bugs showed evidence o...
GitLab: Reporters can upload design to issues using the "Move to" feature
Summary According to the permission documentation, only role of Developer or more can upload Design Management files. However, using the issue "Move to" feature, a reporter can create a issue with designs. Steps to reproduce 1. Consider a private project say Private Project with a member Reporter...
Denial of service
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confidential issues...
UBUNTU-CVE-2020-13287
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confidential issues...
CVE-2020-13287: Undefined Security Weakness
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could see confidential EPIC attached to confidential issues...
PT-2020-13428 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions prior to 13.1.10 GitLab versions prior to 13.2.8 GitLab versions prior to 13.3.4 Description: A vulnerability was discovered that allows project reporters and above to see confidential EPIC attached to confidential issues...
Speakers Censored at AISA Conference in Melbourne
Two speakers were censored at the Australian Information Security Association's annual conference this week in Melbourne. Thomas Drake, former NSA employee and whistleblower, was scheduled to give a talk on the golden age of surveillance, both government and corporate. Suelette Dreyfus, lecturer ...
Arbitrary Code Execution
Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with...
RHEL 7 : firefox (RHSA-2018:2113)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2113 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox...
Critical: Red Hat Security Advisory: firefox security update
An update for firefox is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...