Design/Logic Flaw

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Saphira Saphira Connect allows Reflected XSS.This issue affects Saphira Connect: before 9...

CVE-2023-4663 XSS in Saphira Connect

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Saphira Saphira Connect allows Reflected XSS. This issue affects Saphira Connect: before 9...

Saphira Connect Cross-Site Scripting Vulnerability

Saphira Connect is a mobile application for telephone exchange and call center servers from Saphira Connect, Inc. A cross-site scripting vulnerability exists in versions prior to Saphira Connect 9 that stems from incorrect neutralization of script-related HTML tags in web pages...

GO-2023-2043 Improper handling of special tags within script contexts in html/template

The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack...

[SECURITY] Fedora 37 Update: htmltest-0.17.0-4.fc37

htmltest runs your HTML output through a series of checks to ensure all your links, images, scripts references work, your alt tags are filled in, et cetera...

[SECURITY] Fedora 38 Update: htmltest-0.17.0-4.fc38

htmltest runs your HTML output through a series of checks to ensure all your links, images, scripts references work, your alt tags are filled in, et cetera...

istio security update

istio 1.17.5-1 - Addresses CVE CVE-2023-35941, CVE-2023-35942, CVE-2023-35943, CVE-2023-35944. kubevirt 0.58.0-3 - Ensure that selinux build tags are set for all Go builds olcne 1.7.2-2 - Update kubevirt image versions fixing selinux=enforce not being supported 1.7.2-1 - Add Istio-1.17.5 and...

CVE-2023-4747

A vulnerability classified as critical was found in DedeCMS 5.7.110. This vulnerability affects unknown code of the file /uploads/tags.php. The manipulation of the argument tagalias leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may ...

PT-2023-30462 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.110 Description: A critical issue was found in DedeCMS, affecting the /uploads/tags.php file. The manipulation of the tag alias argument leads to SQL injection. This issue can be exploited remotely. Recommendations: For...

rhel-system-roles bug fix update

An update is available for rhel-system-roles. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The rhel-system-roles package includes a collection of Ansible role...

Hackers Can Exploit Windows Container Isolation Framework to Bypass Endpoint Security

New findings show that malicious actors could leverage a sneaky malware detection evasion technique and bypass endpoint security solutions by manipulating the Windows Container Isolation Framework. The findings were presented by Deep Instinct security researcher Daniel Avinoam at the DEF CON...

Cross-Site Request Forgery (CSRF)

wallabag/wallabag is vulnerable to Cross-Site Request Forgery CSRF. Through the use of a malicious GET request to the /reset/annotations, /reset/entries, /reset/tags, or /reset/archived endpoints, an attacker is able to arbitrary reset annotations, entries, and tags...

Wallabag user can reset data unintentionally

Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived. This vulnerability has a CVSSv3.1 score of 4.3. You...

wallabag 跨站请求伪造漏洞

wallabag is a web application that allows you to save web pages for later reading. A cross-site request forgery vulnerability exists in wallabag versions prior to 2.6.3, which can be exploited by an attacker to arbitrarily delete comments, entries, and tags from an aggrieved user via a GET reques...

PT-2023-27128 · Digoo · Digoo Dg-Hamb Smart Home Security System

Name of the Vulnerable Software and Affected Versions: Digoo DG-HAMB Smart Home Security System version 1.0 Description: The issue is related to missing encryption in the RFID tag of the system, allowing attackers to create a cloned tag via brief physical proximity to the original device. This ca...

answer Security breach

answer is an open source knowledge-based community software. A security vulnerability exists in versions of answer prior to 1.1.1, which stems from a misconfiguration of permissions that allows low-privileged users to create tags...

Siemens SCALANCE X-200RNA Switch Devices Improper Neutralization of Script-Related HTML Tags in a Web Page (CVE-2022-46350)

A vulnerability has been identified in SCALANCE X204RNA HSR All versions V3.2.7, SCALANCE X204RNA PRP All versions V3.2.7, SCALANCE X204RNA EEC HSR All versions V3.2.7, SCALANCE X204RNA EEC PRP All versions V3.2.7, SCALANCE X204RNA EEC PRP/HSR All versions V3.2.7. The integrated web server could...

USN-6269-1 gst-plugins-good1.0 vulnerability

It was discovered that GStreamer Good Plugins incorrectly handled certain FLAC image tags. A remote attacker could use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2023-37327...

USN-6269-1: GStreamer Good Plugins vulnerability

It was discovered that GStreamer Good Plugins incorrectly handled certain FLAC image tags. A remote attacker could use this issue to cause GStreamer Good Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2023-37327...

USN-6268-1 gst-plugins-base1.0 vulnerabilities

It was discovered that GStreamer Base Plugins incorrectly handled certain FLAC image tags. A remote attacker could use this issue to cause GStreamer Base Plugins to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2023-37327 It was discovered that GStreamer Base...