PT-2024-39633 · Unknown · Slim Select

Name of the Vulnerable Software and Affected Versions: Slim Select versions 2.0 through 2.9.0 Description: The issue is a potential cross-site scripting vulnerability. In the createOption function, the text variable from the user-provided Options object is assigned to an innerHTML without...

Slim Select 安全漏洞

Slim Select is an advanced select dropdown menu by Brian Voelker Personal Developer. A security vulnerability exists in Slim Select versions 2.0 through 2.9.0, which stems from a dynamically generated list that is not cleaned of user-supplied input, and is susceptible to a cross-site scripting...

CVE-2024-9440: Improper Neutralization of Input During Web Page Generation

Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption, the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate...

Payment Gateway SLIM CD Data Breach: 1.7 Million Users Impacted

The payment gateway platform SLIM CD suffered a massive data breach between August 2023 and June 2024, compromising…...

slim-pack (>=0.0.1, <=0.0.5) potentially affected by CVE-2024-31999 via @fastify/secure-session (7.1.0)

@fastify/secure-session NPM version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fastify/secure-session and may be impacted: - slim-pack =0.0.1, =0.0.5 Source cves: CVE-2024-31999 Source advisory: OSV:GHSA-9WWP-Q7WQ-JX35...

Malicious code in docker-slim-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c43f388e17851e78ffe6cea282489130b04ea50c71f40d951e492b3128f019d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

HTTP Request Smuggling

slim/psr7 is vulnerable to Insecure Header Validation. The vulnerability exists in the validateHeaderName function in Headers.php, which allows an attacker to sneak in a newline \n into header names and values, potentially resulting in HTTP cache poisoning or phishing attacks...

GHSA-Q2QJ-628G-VHFW Insecure header validation in slim/psr7

Impact An attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An attacker that is able to control the header names that are passed to Slilm-Ps...

Code injection

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

CVE-2023-30536

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

UBUNTU-CVE-2023-30536

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

CVE-2023-30536

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

CVE-2023-30536 Insecure header validation in slim/psr7

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

CVE-2023-30536

CVE-2023-30536 affects slim/psr7 (Slim-Psr7) before 1.6.1, where an attacker controlling header names can inject a newline character into header names and values, potentially producing malformed HTTP messages and causing application errors or a DoS via a remote service firewall. The issue is reso...

CVE-2023-30536 Insecure header validation in slim/psr7

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

CVE-2023-30536 Insecure header validation in slim/psr7

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

Slim psr7 安全漏洞

SLiM Simple Login Manager is a simple, lightweight and easily configurable login manager. A security vulnerability exists in Slim psr7 versions prior to 1.6.1, which originates from an attacker being able to include line breaks in header names and values...

CVE-2023-30536: Interpretation Conflict

slim/psr7 is a PSR-7 implementation for use with Slim 4. In versions prior to 1.6.1 an attacker could sneak in a newline \n into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n. An...

SLiM SQL注入漏洞

SLiM Simple Login Manager is a simple, lightweight and easy to configure login manager. A security vulnerability exists in SLiM 9 Bulian v9.5.0, which originates from SQL injection via the keywords parameter...

GHSA-74MF-VJPG-9XH7 Slim vulnerable to PHP object injection

Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data...