MantisBT XSS via move_attachments_page.php

A cross-site scripting XSS vulnerability in the MantisBT Move Attachments page moveattachmentspage.php, part of admin tools allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection CSP settings allows it. This is fixed in 1.3.9, 2.1.3, an...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the moveattachmentspage.php. An attacker can inject arbitrary web script or HTML by manipulating the 'type' parameter. This is only exploitable if Content Security...

GHSA-X53V-V9XP-GF6G MantisBT XSS via move_attachments_page.php

A cross-site scripting XSS vulnerability in the MantisBT Move Attachments page moveattachmentspage.php, part of admin tools allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection CSP settings allows it. This is fixed in 1.3.9, 2.1.3, an...

org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2014-6439 via org.elasticsearch:elasticsearch (0.6.0)

org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2014-6439 Source advisory:...

org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2015-1427 via org.elasticsearch:elasticsearch (0.6.0)

org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2015-1427 Source advisory:...

org.elasticsearch:elasticsearch-analysis-icu (0.9.0), org.elasticsearch:elasticsearch-client-groovy (0.9.0) +4 more potentially affected by CVE-2015-1427 via org.elasticsearch:elasticsearch (0.9.0)

org.elasticsearch:elasticsearch MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.9.0 - org.elasticsearch:elasticsearch-client-groov...

org.elasticsearch:elasticsearch-analysis-icu (0.7.1), org.elasticsearch:elasticsearch-client-groovy (0.7.1) +3 more potentially affected by CVE-2015-1427 via org.elasticsearch:elasticsearch (0.7.1)

org.elasticsearch:elasticsearch MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.7.1 - org.elasticsearch:elasticsearch-client-groov...

org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2015-4165 via org.elasticsearch:elasticsearch (0.6.0)

org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2015-4165 Source advisory:...

org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2015-5531 via org.elasticsearch:elasticsearch (0.6.0)

org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2015-5531 Source advisory:...

org.elasticsearch:elasticsearch-analysis-icu (0.7.0), org.elasticsearch:elasticsearch-client-groovy (0.7.0) +3 more potentially affected by CVE-2015-5531 via org.elasticsearch:elasticsearch (0.7.0)

org.elasticsearch:elasticsearch MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.7.0 - org.elasticsearch:elasticsearch-client-groov...

GHSA-Q5FG-V5P7-R424 Croogo vulnerable to Cross-site Scripting in title field

A stored self-XSS exists in Croogo before v3.0.7, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4...

Croogo vulnerable to Cross-site Scripting in title field

A stored self-XSS exists in Croogo before v3.0.7, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4...

org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2018-3824 via org.elasticsearch:elasticsearch (0.6.0)

org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2018-3824 Source advisory:...

org.elasticsearch:elasticsearch-analysis-icu (0.7.1), org.elasticsearch:elasticsearch-client-groovy (0.7.1) +3 more potentially affected by CVE-2018-3824 via org.elasticsearch:elasticsearch (0.7.1)

org.elasticsearch:elasticsearch MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.7.1 - org.elasticsearch:elasticsearch-client-groov...

org.elasticsearch:elasticsearch-attachments (0.6.0) potentially affected by CVE-2019-7611 via org.elasticsearch:elasticsearch (0.6.0)

org.elasticsearch:elasticsearch MAVEN version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-attachments 0.6.0 Source cves: CVE-2019-7611 Source advisory:...

org.elasticsearch:elasticsearch-analysis-icu (0.9.0), org.elasticsearch:elasticsearch-client-groovy (0.9.0) +4 more potentially affected by CVE-2019-7611 via org.elasticsearch:elasticsearch (0.9.0)

org.elasticsearch:elasticsearch MAVEN version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - org.elasticsearch:elasticsearch-analysis-icu 0.9.0 - org.elasticsearch:elasticsearch-client-groov...

“Chemical attack” email warnings deliver Jester Stealer malware

Jester Stealer, a malicious file capable of large amounts of data theft, is on the prowl again. The Ukrainian Computer Emergency Response Team CERT-UA has warned of a large distribution campaign abusing a "chemical attack" theme. Receiving an email like this in the invasion-affected regions of...

[SECURITY] Fedora 36 Update: containerd-1.6.2-2.fc36

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

[SECURITY] Fedora 36 Update: containerd-1.6.2-1.fc36

Containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...

FreeBSD : gogs -- XSS in issue attachments (647ac600-cc70-11ec-9cfc-10c37b4ac2ea)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 647ac600-cc70-11ec-9cfc-10c37b4ac2ea advisory. - The gogs project reports: Repository issues page allows HTML attachments with arbitrary JS code...