org.mitre:openid-connect-client (>=1.0.12, <=1.1.0), org.mitre:openid-connect-common (>=1.0.12, <=1.1.0) +3 more potentially affected by CVE-2023-52428 via com.nimbusds:nimbus-jose-jwt (2.17.2)

com.nimbusds:nimbus-jose-jwt MAVEN version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.mitre:openid-connect-client =1.0.12, =1.0.12, =1.0.12, =1.0.12, =1.1.0 -...

activedirectoryenum (>=0.4.7, <=0.5.0), cumulusci (>=3.18.0, <=3.20.0.dev1) +20 more potentially affected by CVE-2024-0727 via cryptography (3.1.0)

cryptography PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - activedirectoryenum =0.4.7, =3.18.0, =1.0.1, =1.0.0, =1.0.0, =0.1.0, =1.3.0, =3.0.0b1, =1.4.0, =1.5.1, =2.1.6 - opacus 0.9.1 - osia...

Pexip Infinity Security Vulnerability

Pexip Infinity is a cloud collaboration platform for video conferencing from Pexip Norway. The product provides high quality and secure cloud conferencing capabilities. A security vulnerability exists in Pexip Infinity prior to version 32, which stems from a cross-site scripting XSS vulnerability...

GHSA-7664-HCP7-F497 Mattermost Injection vulnerability

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

Mattermost Injection vulnerability

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

CVE-2023-6458

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

Path traversal

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

CVE-2023-6458

CVE-2023-6458 (Mattermost webapp) : A route-parameter validation failure in //channels/ allows client-side path traversal. Root cause: insufficient validation of route parameters in the webapp. Impact: potential exposure of sensitive client-side state via crafted channel URLs; exploitation status...

CVE-2023-6458 Client side path traversal due to lack of route parameters validation

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

CVE-2023-6458 Client side path traversal due to lack of route parameters validation

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

CVE-2023-6458

Mattermost webapp fails to validate route parameters in//channels/ allowing an attacker to perform a client-side path traversal...

CVE-2023-6458: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Mattermost webapp fails to validate route parameters in/ /channels/ allowing an attacker to perform a client-side path traversal...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.webapp.modules:cloud-altemistafwk-webapp-tiles (>=3.0.0.release, <=3.1.0.release) +157 more potentially affected by CVE-2023-49735 via org.apache.tiles:tiles-core (>=2.0.1, <=3.0.8)

org.apache.tiles:tiles-core MAVEN version =2.0.1, =3.0.0.release, =3.0.0.release, =2.1.0, =1.2.2, =1.0.0, =1.0.1, =0.0.1, =1.0.14-vaadin1, =0.0.3, =0.0.3, =0.0.10 and more Source cves: CVE-2023-49735 Source advisory: GHSA-QW4H-3XJJ-84CC...

GHSA-JCGV-3PFQ-J4HR Mattermost Injection vulnerability

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

Mattermost Injection vulnerability

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

CVE-2023-35075

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

Hardcoded credentials

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

CVE-2023-35075 HTML injection via channel autocomplete

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

CVE-2023-35075 HTML injection via channel autocomplete

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

CVE-2023-35075

CVE-2023-35075 : Mattermost webapp vulnerability where channel names set during autocomplete do not use innerText/textContent, enabling HTML injection into a victim’s page when a name contains HTML. The attack does not produce XSS according to the sources. Affected component is the Mattermost web...