SUSE-SU-2024:1670-1 Security update for python-azure-core, python-azure-storage-blob, python-azure-storage-queue, python-typing, python-typing_extensions

This update for python-azure-core, python-azure-storage-blob, python-azure-storage-queue, python-typing, python-typingextensions fixes the following issues: - CVE-2022-30187: Fixed an information disclosure issue that an attacker could exploit to leak sensitive information on the client side...

Improper Input Validation

Overview Microsoft.PowerBI.JavaScript is a suite of JavaScript web components for integrating Power BI into your app. Affected versions of this package are vulnerable to Improper Input Validation via the client-side data handling process. An attacker can expose sensitive information by intercepti...

CVE-2024-31491

A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute unauthorized code or commands via HTTP requests...

CVE-2024-31491

A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute unauthorized code or commands via HTTP requests...

CVE-2024-31491

A client-side enforcement of server-side security vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6 allows attacker to execute unauthorized code or commands via HTTP requests...

CVE-2024-31491

CVE-2024-31491 affects Fortinet FortiSandbox components (FortiSandbox 4.2.0–4.2.6 and 4.4.0–4.4.4). The issue stems from client-side enforcement of server-side security, enabling an attacker to execute unauthorized code or commands via HTTP requests. The connected sources specify the affected ver...

CVE-2024-30209

CVE-2024-30209 affects SIMATIC RTLS Locating Manager (multiple SKUs) with versions

CVE-2024-33007 Client-side script execution vulnerability in SAP UI5(PDFViewer)

PDFViewer is a control delivered as part of SAPUI5 product which shows the PDF content in an embedded mode by default. If a PDF document contains embedded JavaScript or any harmful client-side script, the PDFViewer will execute the JavaScript embedded in the PDF which can cause a potential securi...

PT-2024-3561 · Fortinet · Fortisandbox

Name of the Vulnerable Software and Affected Versions: FortiSandbox versions 4.2.0 through 4.2.6 FortiSandbox versions 4.4.0 through 4.4.4 Description: The issue is related to the client-side enforcement of server-side security in FortiSandbox. It allows an attacker to execute unauthorized code o...

PT-2024-25052 · Sap · Sapui5

Name of the Vulnerable Software and Affected Versions: SAPUI5 affected versions not specified Description: The issue concerns the execution of embedded JavaScript in PDF documents by the PDFViewer control in SAPUI5. If a PDF contains harmful client-side scripts, including JavaScript, the PDFViewe...

CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...

CVE-2024-23187

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please...

Cross-Site Scripting (XSS)

pgAdmin is vulnerable to a Cross-site Scripting XSS in the JSON payload of the /settings/store API response. The vulnerability arises due to inadequate input sanitization, enabling attackers to inject and execute malicious scripts on the client's side...

CVE-2024-23187

Open-Xchange App Suite (OX App Suite) is affected by CVE-2024-23187 in versions up to 8.21. The issue arises from Content-ID based embedding of resources in emails, which could be abused to trigger client-side script code when using the “show more” option. Attackers could perform malicious API re...

CVE-2024-23187

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please...

CVE-2024-23187

Content-ID based embedding of resources in E-Mails could be abused to trigger client-side script code when using the "show more" option. Attackers could perform malicious API requests or extract information from the users account. Exploiting the vulnerability requires user interaction. Please...

CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...

CVE-2024-23186

Summary: CVE-2024-23186 affects Open-Xchange Open-Xchange App Suite (see connected sources). An email contains malicious display-name information that can trigger client-side script execution on specific mobile devices, enabling attackers to perform malicious API requests or extract data from use...

CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...

PT-2024-19702 · Open Xchange Gmbh +1 · Ox App Suite

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could...