11 matches found
CVE-2026-93879
A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be...
SUSE-SU-2026:23314-1 Security update for dracut
This update for dracut fixes the following issue: Update to version 059+suse.726.gde083b3a1. Securitys issue fixed: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: - Fixbase: sanitize message...
OPENSUSE-SU-2026:21639-1 Security update for dracut
This update for dracut fixes the following issue: Update to version 059+suse.726.gde083b3a1. Securitys issue fixed: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: - Fixbase: sanitize message...
SUSE-SU-2026:23195-1 Security update for dracut
This update for dracut fixes the following issue: Update to version 059+suse.645.g79fd74d. Securitys issue fixed: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: - Fixbase: sanitize message...
SUSE-SU-2026:23246-1 Security update for dracut
This update for dracut fixes the following issue: Update to version 059+suse.611.g7d90691. Securitys issue fixed: - CVE-2026-15816: root code execution via unescaped error message written to sourced emergency-hook script in die bsc1274432. Other updates and bugfixes: - Fixbase: sanitize message...
CVE-2026-52760 Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a J...
CVE-2020-15178
In PrestaShop contactform module prestashop/contactform before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The message field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser...
PT-2023-17261 · WordPress · Wp Inventory Manager
Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.1.0.12 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because the message parameter is not properly sanitised and escaped before being outputted back in the page...
CVE-2020-36599
lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...
