CVE-2024-34686

Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify...

PT-2024-25822 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue is related to an out-of-memory OOM vector exposed by Envoy, a cloud-native, open source edge and service proxy. This occurs because the async HTTP client buffers the response with a...

The vulnerability of the user interface of the SAP CRM WebClient UI, which allows an attacker to perform XSS attacks.

The vulnerability of the SAP CRM WebClient UI user interface lies in the lack of security measures taken to protect the web page structure. Exploiting this vulnerability allows an attacker to execute XSS attacks remotely...

io.vertx/vertx-core: memory leak due to the use of Netty FastThreadLocal data structures in Vertx

A vulnerability in the Eclipse Vert.x toolkit results in a memory leak due to using Netty FastThreadLocal data structures. Specifically, when the Vert.x HTTP client establishes connections to different hosts, triggering the memory leak. The leak can be accelerated with intimate runtime knowledge,...

python-urllib3: Cookie request header isn't stripped during cross-origin redirects

A flaw was found in urllib3, a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, which is the responsibility of the user. However, it is possible for a user to specify a Cookie header and...

Mattermost crashes web clients via a malformed custom status

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status...

CVE-2024-4182

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom status values, which allows an authenticated attacker to crash other users' web clients via a malformed custom status...

Mattermost 代码问题漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that originates from an authenticated attacker being able to access the web client via a misformatted customized state. The vulnerability affects the...

CVE-2024-28287

A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL...

GBG Instinct 安全漏洞

GBG Instinct is an advanced anti-fraud and compliance management solution from GBG. A security vulnerability exists in the GBG Instinct UI Web Client version 6.5.0 that stems from an open redirection vulnerability in the returnUrl parameter, which allows an attacker to redirect users to a malicio...

CVE-2024-28287

A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL...

PT-2024-22381 · Unknown · Instinct Ui Web Client

Name of the Vulnerable Software and Affected Versions: INSTINCT UI Web Client version 6.5.0 Description: A DOM-based open redirection in the returnUrl parameter allows attackers to redirect users to malicious sites via a crafted URL. Recommendations: For INSTINCT UI Web Client version 6.5.0,...

CVE-2024-28287

A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL...

CVE-2024-28287

CVE-2024-28287 describes a DOM-based open redirection in the INSTINCT UI Web Client, version 6.5.0, where the returnUrl parameter can be manipulated to redirect users to attacker‑controlled sites. The issue is documented across multiple feeds (NVD, Red Hat, CVE lists) with the same root cause: im...

BIT-MATTERMOST-2023-7113

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client...

CVE-2024-24742 Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)

SAP CRM WebClient UI - version S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker wi...

SAP CRM Cross-Site Scripting Vulnerability

SAP CRM is a customer relationship management system from SAP, Germany. SAP CRM WebClient UI S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, A cross-site scripting vulnerability exists in WEBCUIF version 801, whi...

PT-2024-3898 · Sap · Sap Crm Webclient Ui

Name of the Vulnerable Software and Affected Versions: SAP CRM WebClient UI versions S4FND 102 through S4FND 106 SAP CRM WebClient UI versions WEBCUIF 701 through WEBCUIF 801 Description: The SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site...

PT-2024-13276 · Ibm · Sametime

Name of the Vulnerable Software and Affected Versions: Sametime affected versions not specified Description: The issue is related to a failure to invalidate sessions in Sametime. Sensitive cookie values are set in a persistent manner in Sametime Web clients, allowing these values to remain valid...

PT-2024-16128 · Eclipse · Eclipse Vert.X

Name of the Vulnerable Software and Affected Versions: Eclipse Vert.x versions prior to 4.4.7 Eclipse Vert.x versions prior to 4.5.2 Description: A memory leak occurs in the Eclipse Vert.x toolkit due to the use of Netty FastThreadLocal data structures. This issue is triggered when the Vert.x HTT...