SUSE-SU-2024:4253-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 128.5.1 ESR: - Fixed: Fixed an issue that prevented some websites from loading when using SSL Inspection. bmo1933747...

PT-2024-41016

Name of the Vulnerable Software and Affected Versions MozillaFirefox versions prior to Extended Support Release 128.5.1 ESR Description The issue prevented some websites from loading when using SSL Inspection. Recommendations For versions prior to Extended Support Release 128.5.1 ESR, update to...

The vulnerability of cloud-based software for creating and using Nextcloud Server and Nextcloud Enterprise Server lies in the lack of security measures for website structures, allowing attackers to trigger service failures.

The vulnerability of cloud-based software for creating and using Nextcloud Server and Nextcloud Enterprise Server is related to the lack of protective measures for the website structure. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from the lack of protective measures for website structures, allowing attackers to trigger service interruptions.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor, operating remotely, to trigger a service failure using a speciall...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2024-54014

Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead the application to access an arbitrary web site via another application installed on the user's device...

PT-2024-36015

Name of the Vulnerable Software and Affected Versions: Skylark App for Android versions 6.2.13 and earlier Skylark App for iOS versions 6.2.13 and earlier Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing an attacker to lead the applicati...

The vulnerability of the Microsoft Dynamics 365 resource planning software lies in the lack of protective measures for the website structure, allowing attackers to execute a spear-phishing attack.

The vulnerability of the Microsoft Dynamics 365 resource planning software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute a spear-phishing attack remotely...

The vulnerability of the monitoring tool for VMware Aria Operations, related to the lack of protective measures for the website structure, allows attackers to execute cross-site scripting attacks (XSS).

The vulnerability of the monitoring tool for VMware Aria Operations is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the monitoring tool for VMware Aria Operations, related to the lack of protective measures for the website structure, allows attackers to execute cross-site scripting attacks (XSS).

The vulnerability of the monitoring tool for VMware Aria Operations is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the monitoring tool for VMware Aria Operations, related to the lack of protective measures for the website structure, allows attackers to execute cross-site scripting attacks (XSS).

The vulnerability of the monitoring tool for VMware Aria Operations is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

webkit: maliciously crafted webpage may be able to fingerprint the user

A flaw was found in WebKit. This flaw allows remote attackers to bypass security restrictions through an injection issue by persuading a victim to access a specially crafted website, enabling the attackers to fingerprint the user...

webkit: processing maliciously crafted web content prevents Content Security Policy from being enforced

A flaw was found in WebKit. This flaw allows remote attackers to bypass security restrictions due to a logic flaw by persuading a victim to access a specially crafted website, enabling attackers to circumvent the Content Security Policy enforcement...

webkit: malicious website may exfiltrate audio data cross-origin

A vulnerability was found in WebKit, where a remote attacker is able to exfiltrate audio data cross-origin by convincing a victim to visit a specially crafted website, which results in obtaining sensitive information...

CVE-2024-8236

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2024-8236

The CVE-2024-8236 entry concerns Elementor Website Builder for WordPress (versions

WordPress Elementor Website Builder – More than Just a Page Builder plugin <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Elementor Website Builder versions = 3.25.7...

WordPress plugin Elementor Website Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-8236: Improper Neutralization of Input During Web Page Generation

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and output escaping. This makes it possibl...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE lies in the lack of measures taken to protect the website structure, allowing attackers to inject arbitrary JavaScript code.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript code through a specially created UR...