CVE-2024-11070 Sanluan PublicCMS Tag Type save cross site scripting

A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack ma...

CVE-2024-11070 Sanluan PublicCMS Tag Type save cross site scripting

A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack ma...

CVE-2024-11070 Sanluan PublicCMS Tag Type save cross site scripting

A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS 5.202406.d. This issue affects some unknown processing of the file /admin/cmsTagType/save of the component Tag Type Handler. The manipulation of the argument name leads to cross site scripting. The attack ma...

CVE-2024-11070

CVE-2024-11070 affects Sanluan PublicCMS 5.202406.d. The issue is a cross-site scripting vulnerability in the Tag Type Handler, specifically in the /admin/cmsTagType/save endpoint where manipulation of the argument name enables XSS. The vulnerability can be triggered remotely and the exploit has ...

[SECURITY] Fedora 41 Update: expat-2.6.4-1.fc41

This is expat, the C library for parsing XML, written by James Clark. Expat is a stream oriented XML parser. This means that you register handlers with the parser prior to starting the parse. These handlers are called when the parser discovers the associated structures in the document being parse...

DEBIAN-CVE-2024-50212

In the Linux kernel, the following vulnerability has been resolved: lib: alloctagmoduleunload must wait for pending kfreercu calls Ben Greear reports following splat: ------------ cut here ------------ net/netfilter/nfnatcore.c:1114 module nfnat func:nfnatregisterfn has 256 allocated at module...

UBUNTU-CVE-2024-50212

In the Linux kernel, the following vulnerability has been resolved: lib: alloctagmoduleunload must wait for pending kfreercu calls Ben Greear reports following splat: ------------ cut here ------------ net/netfilter/nfnatcore.c:1114 module nfnat func:nfnatregisterfn has 256 allocated at module...

CVE-2024-52007

CVE-2024-52007 is an XXE vulnerability in XSLT parsing within the HAPI FHIR org.hl7.fhir.core components. The issue arises from XML external entity injections when processing XML with a malicious DTD, potentially allowing host data to be exposed. The Red Hat advisory notes this is fixed by upgrad...

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

Summary XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external...

GHSA-GR3C-Q7XF-47VH XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

Summary XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external...

go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion

A flaw was found in the go/build/constraint package of the Golang standard library. Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion...

CVE-2024-51757

A flaw was found in happy-dom. This vulnerability allows remote code execution via a script tag, potentially executing code in the user context of happy-dom...

DEBIAN-CVE-2024-50203

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPFTRAMPFCALLORIG is enabled, the address of a bpftrampimage struct on the stack is passed during the size calculation pass and an address on the heap is passed...

UBUNTU-CVE-2024-50203

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPFTRAMPFCALLORIG is enabled, the address of a bpftrampimage struct on the stack is passed during the size calculation pass and an address on the heap is passed...

CVE-2024-50203 bpf, arm64: Fix address emission with tag-based KASAN enabled

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fix address emission with tag-based KASAN enabled When BPFTRAMPFCALLORIG is enabled, the address of a bpftrampimage struct on the stack is passed during the size calculation pass and an address on the heap is passed...

GHSA-549P-5C7F-C5P4 Froala WYSIWYG editor allows cross-site scripting (XSS)

Inconsistent tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier...

Froala WYSIWYG editor allows cross-site scripting (XSS)

Inconsistent tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier...

XXE vulnerability in XSLT parsing in `org.hl7.fhir.core`

XSLT parsing performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where org.hl7.fhir.core is being used to within a host where external clients...

UBUNTU-CVE-2023-1932

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or...

PT-2024-34634 · Froala · Froala Wysiwyg Editor

Name of the Vulnerable Software and Affected Versions: Froala WYSIWYG editor versions 4.3.0 and earlier Description: The issue is related to inconsistent parsing of the tag, which allows for cross-site scripting XSS in the Froala WYSIWYG editor. Recommendations: For versions 4.3.0 and earlier,...