SYS.2.3.A7

Es SOLLTE sichergestellt werden, dass Dienste und Anwendungen nur die ihnen zugeordneten Dateien erstellen, veraendern oder loeschen duerfen. Auf Verzeichnissen, in denen alle Benutzer Schreibrechte haben z. B. /tmp, SOLLTE das Sticky Bit gesetzt werden. SPDX-FileCopyrightText: 2021 Greenbone AG...

Sticky Notes Apps Using JavaScript 1.0 Cross Site Scripting

Exploit Title: Sticky Note Apps using JavaScript | Stored Cross Site Scripting Exploit Author: Richard Jones Date: 2021-03-09 Vendor Homepage: https://www.sourcecodester.com/javascript/14742/sticky-note-apps-using-javascript-source-code.html Software Link:...

Cross-site Scripting (XSS)

flarum/sticky is vulnerable to cross-site scripting. An attacker with the ability to pin their own discussion, or be able to edit a discussion that was previously pinned is able to inject and execute an arbitrary script via Mithril's m.trust helper while the extension is enabled...

XSS in Flarum Sticky extension

Impact A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through Mithril's m.trust helper. This...

GHSA-H3GG-7WX2-CQ3H XSS in Flarum Sticky extension

Impact A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit. Any HTML would be injected through Mithril's m.trust helper. This...

CVE-2021-21283

Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...

CVE-2021-21283

Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...

Cross site scripting

Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...

CVE-2021-21283

Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...

CVE-2021-21283 XSS in Flarum Sticky extension.

Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...

CVE-2021-21283

Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...

CVE-2021-21283

The CVE-2021-21283 issue affects Flarum’s Sticky extension (versions 0.1.0-beta.14 and 0.1.0-beta.15). A change in beta 14 causes the first post of a pinned discussion to be injected as HTML on the discussion list via Mithril’s m.trust(), enabling a cross-site scripting (XSS) attack. Affected: Fl...

CVE-2021-21283: Improper Neutralization of Input During Web Page Generation

Flarum is an open source discussion platform for websites. The "Flarum Sticky" extension versions 0.1.0-beta.14 and 0.1.0-beta.15 has a cross-site scripting vulnerability. A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to...

PT-2021-14388

Name of the Vulnerable Software and Affected Versions: Flarum Sticky extension versions 0.1.0-beta.14 through 0.1.0-beta.15 Description: The Flarum Sticky extension has a cross-site scripting vulnerability. A change in release beta 14 caused the plain text content of the first post of a pinned...

Flarum Sticky Cross-Site Scripting Vulnerability

Flarum is an open source forum system for the Flarum community. A cross-site scripting vulnerability exists in Flarum Sticky extension versions 0.1.0-beta.14 and 0.1.0-beta.15, which can be exploited by attackers to run javascript from other HTML attributes...

WordPress Sticky Menu, Sticky Header (or anything!) on Scroll plugin <= 2.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by Antony Garand Sucuri in WordPress Sticky Menu, Sticky Header or anything! on Scroll plugin versions = 2.2. Solution Update the WordPress Sticky Menu, Sticky Header or anything! on Scroll plugin to the latest available version at least 2.21...

SUSE-RU-2020:0603-1 Recommended update for permissions

This update for permissions fixes the following issues: - CVE-2020-8013: Fixed an improper check which could have allowed the setting of unintented setuid bits bsc1163922. - Fixed handling of relative directory symlinks in chkstat. - Whitelisted postgres sticky directories bsc1123886. - Fixed...

Threat Analysis Unit (TAU) Threat Intelligence Notification: MailTo (NetWalker) Ransomware

MailTo is a ransomware variant that has recently been reported to have been part of a targeted attack against Toll Group, an Australian freight and logistics company. This ransomware makes no attempt to remain stealthy, and quickly encrypts the user’s data as soon as the ransomware is launched...

Linux kernel may_create_in_sticky denial-of-service vulnerability

Linux kernel is an open source operating system. Linux kernel fs/namei.c maycreateinsticky suffers from a use-after-release vulnerability that can be exploited by a local attacker to submit a special request that can crash the system...

DEBIAN-CVE-2020-8428

fs/namei.c in the Linux kernel before 5.5 has a maycreateinsticky use-after-free, which allows local users to cause a denial of service OOPS or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket, if...