CVE-2024-39926

An issue was discovered in Vaultwarden formerly BitwardenRS 1.30.3. A stored cross-site scripting XSS or, due to the default CSP, HTML injection vulnerability has been discovered in the admin dashboard. This potentially allows an authenticated attacker to inject malicious code into the dashboard,...

CVE-2024-45303

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

PT-2024-31556 · Discourse · Discourse Calendar Plugin

Name of the Vulnerable Software and Affected Versions: Discourse Calendar plugin versions prior to 0.5 Description: The Discourse Calendar plugin is susceptible to XSS attacks when rendering event names. This issue only affects sites that have modified or disabled Discourse's default Content...

Discourse Calendar 跨站脚本漏洞

Discourse Calendar is an open source calendar plugin for Discourse. A cross-site scripting vulnerability exists in versions of Discourse Calendar prior to 0.5, which stems from a problem with the dynamic calendar functionality that may be vulnerable to XSS attacks when rendering event names. This...

DRUPAL-CONTRIB-2024-039

This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers. The module doesn't sufficiently validate input in Content Security Policy CSP violation reports. This can cause errors when a logging module e.g. dblog or syslo...

CVE-2024-1656

Affected versions of Octopus Server had a weak content security policy...

CVE-2024-1656

Affected versions of Octopus Server had a weak content security policy...

CVE-2024-1656

Affected versions of Octopus Server had a weak content security policy...

CVE-2024-1656

CVE-2024-1656 affects Octopus Server; vulnerable component is the web content security policy implementation, described as a weak CSP. CVSSv3.1 base score 2.6 (Low) with Network attack vector, High attack complexity, Privileges required Low, User interaction Required. The exploitation status is n...

Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers. The module doesn't sufficiently validate input in Content Security Policy CSP violation reports. This can cause errors when a logging module e.g. dblog or syslo...

Octopus Server 安全漏洞

Octopus Server is a deployment automation and release management tool for continuous delivery from Octopus Australia. Octopus Server has a security vulnerability that stems from a weak content security policy...

PT-2024-18204 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue is related to a weak content security policy in affected versions of the software. There is no information provided about the estimated number of potentially affected devic...

CVE-2024-45299

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...

CVE-2024-45299 alf.io's preloaded data as json is not escaped correctly

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...

CVE-2024-45299

alf.io prior to version 2.0-M5 has an input escaping flaw in preloaded JSON data that can cause installation instability when administrators insert non-escaped text. The issue is mitigated by upgrading to version 2.0-M5, which fixes the escaping problem. The CSP blocks script execution; no exploi...

OESA-2024-2120 mozjs78 security update

SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security...

OESA-2024-2099 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site...

PT-2024-31552 · Alf.Io · Alf.Io

Name of the Vulnerable Software and Affected Versions: alf.io versions prior to 2.0-M5 Description: The issue concerns an open source ticket reservation system for events. Prior to version 2.0-M5, the preloaded data as JSON is not escaped correctly. This allows an administrator or event admin to...

[SECURITY] [DLA 3863-1] nbconvert security update

Debian LTS Advisory DLA-3863-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin September 02, 2024 https://wiki.debian.org/LTS Package : nbconvert Version : 5.6.1-3+deb11u1 CVE ID : CVE-2021-32862 Alvaro Muñoz from the GitHub Security Lab discovered sixteen ways to...

The vulnerability of the Content Security Policy component in Firefox browsers, including Firefox ESR, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Content Security Policy component in Firefox browsers and Firefox ESR browsers is related to the failure to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to perform cross-site scripting attacks remotely...