Security Vulnerabilities fixed in Thunderbird 91.11 and Thunderbird 102 — Mozilla

A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks. This bug only affects Thunderbird for Linux. Other operating systems are unaffected. Session history navigations m...

SoftGuard SNMP Network Management Extension HTML Injection / File Download Vulnerability

======================================================================= title: Multiple vulnerabilities product: SoftGuard SNMP Network Management Extension vulnerable version: SoftGuard Web SGW 5.1.5 fixed version: SoftGuard version 5.1.5 from 2022-06-01 CVE number: CVE-2022-31201, CVE-2022-3120...

CVE-2022-31059

Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Conte...

Cross site scripting

Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Conte...

CVE-2022-31059 Discourse Calendar Event names susceptible to Cross-site Scripting

Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Conte...

CVE-2022-31059 Discourse Calendar Event names susceptible to Cross-site Scripting

Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Conte...

CVE-2022-31059 Discourse Calendar Event names susceptible to Cross-site Scripting

Discourse Calendar is a calendar plugin for Discourse, an open-source messaging app. Prior to version 1.0.1, parsing and rendering of Event names can be susceptible to cross-site scripting XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Conte...

CVE-2022-31059

CVE-2022-31059 affects the Discourse Calendar plugin for Discourse. Before version 1.0.1, parsing and rendering of Event names can be vulnerable to cross-site scripting (XSS) attacks when a site has modified or disabled Discourse’s default Content Security Policy. The issue is patched in version ...

Ubuntu: Security Advisory (USN-5475-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-5475-1: Firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, spoof the browser UI, conduct cross-site scripting XSS attacks, bypass...

UBUNTU-CVE-2022-31744

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...

CVE-2022-31744

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR 91.11, Thunderbird 102, Thunderbird 91.11, and Firefox 101...

Mozilla Firefox < 101.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 101.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-20 advisory. - Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Tea...

Mozilla Firefox < 101.0

The version of Firefox installed on the remote Windows host is prior to 101.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-20 advisory. - Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported...

CVE-2022-22577

An XSS Vulnerability in Action Pack = 5.2.0 and 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses...

UBUNTU-CVE-2022-22577

An XSS Vulnerability in Action Pack = 5.2.0 and 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses...

Rails Action Pack 跨站脚本漏洞

Rails Action Pack is a web framework for the Rails community in the United States . It provides a mechanism for routing mapping request URLs to actions, defining controllers that implement actions, and generating responses by rendering views templates in various formats. A security vulnerability...

GHSA-FF28-F46G-R9G8 Cross-site Scripting in Gogs

Impact The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG text/xml files as issue attachments non-default are affected. Patches Correctly setting the Content Security Policy for the serving endpoint. Users should...

Cross-site Scripting in Gogs

Impact The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG text/xml files as issue attachments non-default are affected. Patches Correctly setting the Content Security Policy for the serving endpoint. Users should...

Reflected XSS vulnerability in Jenkins markup formatter preview

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered. Jenkins 2.274 and earlier, LTS...