Security Bulletin: IBM Watson Query on IBM Cloud does not govern all of the columns of a published object

Summary IBM Watson Query on IBM Cloud integrates with IBM Knowledge Catalog IKC - formerly Watson Knowledge Catalog WKC - to enforce data protection rules on governed objects. When you publish objects from Watson Query to catalogs or projects, only the first 100 columns are registered in the...

CVE-2024-43413 Xibo CMS XSS vulnerability using DataSet HTML columns

Xibo is an open source digital signage platform with a web content management system CMS. Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which...

Google Android Information Disclosure Vulnerability (CNVD-2025-18828)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability due to incorrect input validation in ensureFileColumns of MediaProvider.java. An attacker can exploit the vulnerability to obtain sensitive information...

CVE-2024-34721

In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability due to incorrect input validation in ensureFileColumns of MediaProvider.java. An attacker can exploit the vulnerability to obtain sensitive information...

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.

...

An issue was discovered in the nalgebra crate before 0.27.1 for Rust. It allows out-of-bounds memory access because it does not ensure that the number of elements is equal to the product of the row count and column count.

...

CVE-2024-37384

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences...

UBUNTU-CVE-2024-37384

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences...

CVE-2024-37384

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences...

CVE-2024-37384

Roundcube Webmail versions prior to 1.5.7 and 1.6.x before 1.6.7 are vulnerable to a Cross-Site Scripting (XSS) flaw. The root cause is the incorrect handling of certain fields within user preferences by the application. A remote attacker can exploit this vulnerability to execute arbitrary JavaSc...

CVE-2024-37384: Improper Neutralization of Input During Web Page Generation

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences...

[SECURITY] Fedora 40 Update: rust-uu_cut-0.0.23-3.fc40

cut uutils display byte/field columns of input lines...

WordPress Plugin WEN Responsive Columns 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin WEN Responsive Columns A cross-sit...

CVE-2024-27988 WordPress WEN Responsive Columns plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2...

PT-2024-22185 · Unknown · Wen Responsive Columns

Name of the Vulnerable Software and Affected Versions: WEN Responsive Columns versions 1.3.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

CVE-2024-27988: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2...

WordPress WEN Responsive Columns Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

Software WEN Responsive Columns Type Plugin Vulnerable versions = 1.3.2 Fixed in 1.3.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-27988 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID c2f6dd98b9ce Credits LVT-tholv2k Required privilege...

PT-2024-20753 · Mediawiki · Managewiki

Name of the Vulnerable Software and Affected Versions: ManageWiki affected versions not specified Description: ManageWiki is a MediaWiki extension that allows users to manage wikis. The issue arises because Special:ManageWiki does not properly escape interface messages on the columns and help key...

CVE-2024-25109: Improper Neutralization of Input During Web Page Generation

ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the columns and help keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires...