apache: cxf: org.apache.cxf:cxf-rt-rs-service-description: SSRF via WADL stylesheet parameter

A Server-side request forgery SSRF vulnerability has been identified in Apache CXF in the WADL service description. The flaw allows an attacker to perform SSRF-style attacks on REST web services. The attack only applies if a custom stylesheet parameter is configured...

The vulnerability of the mod_css_styles function in the Cascading Style Sheet Handler component of the RoundCube email client allows a hacker to disclose confidential information.

The vulnerability of the modcssstyles function in the Cascading Style Sheet Handler component of the RoundCube email client is related to insufficient filtering of the sequence of tokens in CSS styles displayed in email messages. Exploiting this vulnerability could allow an attacker to disclose...

CVE-2024-6688 Oxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update

The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxysavecssfromadmin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and...

WordPress Oxygen Builder plugin <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update vulnerability

Missing Authorization to Authenticated Subscriber+ Stylesheet Update vulnerability discovered by Francesco Carlucci in WordPress Plugin Oxygen Builder versions = 4.8.3...

The vulnerability of the WADL (Web Application Description Language) technology used in the Apache CXF web service framework allows a attacker to perform an SSRF attack.

The vulnerability of the WADL Web Application Description Language framework for Apache CXF lies in the possibility of modifying requests on the server side due to incorrect transformation of style sheets. Exploiting this vulnerability could allow a malicious actor to execute an SSRF attack...

The vulnerability of the GLPI system’s request and incident handling process, related to incorrect input cancellation during the generation of web pages, allows attackers to carry out attacks using cross-site scripting.

The vulnerability of the GLPI request and incident handling system is related to the use of ticket actions or the configuration of messages that include links to style sheets. Exploiting this vulnerability allows a malicious actor to carry out an attack using cross-site scripting...

GHSA-5M3J-PXH7-455P Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

CVE-2024-29736 Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

CVE-2024-29736 Apache CXF: SSRF vulnerability via WADL stylesheet parameter

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on REST webservices. The attack only applies if a custom stylesheet parameter is configured...

Apache Wicket Injection Vulnerability

Apache Wicket is a set of open source, lightweight, component-based frameworks from the Apache Foundation that provide an object-oriented approach to developing dynamic Web-based UI applications. Apache Wicket suffers from an injection vulnerability that stems from the default configuration of...

MAL-2024-7718 Malicious code in stylesheeet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e689b39fcbd1dcf313116508aacf3c6f500651a7b60d276583e09895a98324e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7473 Malicious code in stylessheet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c699b62f26d34d9451a1828e31f99fa2b56dcb013f6979c6728088b69db70426 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-12890 · Undefined · Undefined

ChatGPT помог заработать $28 000 на 0-day. Базовый XXE-пейлоад выглядит как-то так Можно залить файл с таким содержимым на сервер и, если у либы, которая его распарсит, включена поддержка внешних сущностей, на выходе мы получим содержимое /etc/passwd. Это касается библиотек, но не браузеров. Если...

PT-2024-15096 · WordPress · Wp Compress – Image Optimizer

Name of the Vulnerable Software and Affected Versions: WP Compress – Image Optimizer versions up to, and including, 6.20.01 Description: The issue is related to insufficient validation on the redirect URL supplied via the css parameter, allowing unauthenticated attackers to redirect users to...

apache: cxf: org.apache.cxf:cxf-rt-rs-service-description: SSRF via WADL stylesheet parameter

A Server-side request forgery SSRF vulnerability has been identified in Apache CXF in the WADL service description. The flaw allows an attacker to perform SSRF-style attacks on REST web services. The attack only applies if a custom stylesheet parameter is configured...

CLSA-2024-1712176929 Update of libxslt

Fix use-after-free in xsltApplyTemplates...

PT-2024-5337 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 4.0.5 Apache CXF versions prior to 3.6.4 Apache CXF versions prior to 3.5.9 Description: A SSRF vulnerability in the WADL service description of Apache CXF allows an attacker to perform SSRF style attacks on REST...

Adobe Commerce Security Breach

Adobe Commerce is a leading global digital commerce solution for merchants and brands from Adobe. A security vulnerability exists in Adobe Commerce that stems from an XSLT server injection vulnerability in the Import Jobs function of the FireBear Improved Import And Export plugin...

PT-2024-20928 · Unknown · Firebear Improved Import/Export

Name of the Vulnerable Software and Affected Versions: FireBear Improved Import And Export version 3.8.6 Description: A XSLT Server Side injection vulnerability in the Import Jobs function allows attackers to execute arbitrary commands via a crafted XSLT file. The vulnerability can be exploited b...