Astra Linux – Vulnerability in WebKit2GTK

A permissions issue has been addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4, and iPadOS 18.4. Loading a malicious iframe may lead to a cross-site scripting attack...

Astra Linux – Vulnerability in Rails

An XSS vulnerability exists in the Action View tag helpers versions 5.2.0 and below, which would allow an attacker to inject content if they can control the input into specific attributes...

Astra Linux – Vulnerability in Mercurial

A vulnerability was discovered in Mercurial SCM 4.5.3/71.19.145.211. This vulnerability is considered problematic. It affects unknown code within the Web Interface component. Manipulating the cmd argument leads to cross-site scripting attacks. The attack can be initiated remotely. The exploit has...

Astra Linux – Vulnerability in Tomcat9

Improper neutralization of script-related HTML tags in a web page constitutes an XSS vulnerability in the number guessing example for Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.22, 10.1.0-M1 through 10.1.55, 9.0.0.M1 through 9.0.118, 8.5.0 through...

Astra Linux – Vulnerability in Firefox and Thunderbird

When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag. This could potentially make a website vulnerable to a cross-site scripting attack. This vulnerability has been fixed in Firefox 140, Firefox ESR 128.12,...

Astra Linux – Vulnerability in Golang-1.19

The html/template package does not follow the correct rules for handling occurrences of "", "" within JS literals in contexts. This may cause the template parser to incorrectly consider script contexts as being terminated early, resulting in actions being properly escaped incorrectly. This could ...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS protections through a malicious file. Chromium security severity: High...

Astra Linux – Vulnerability in ruby-rails-html-sanitizer

Rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions starting from 1.0.3 and before 1.4.4 are vulnerable to cross-site scripting through data URIs when used in conjunction with Loofah version 2.1.0 or higher. This issue has been fixed in version 1.4.4...

Astra Linux – Vulnerability in Zabbix

The endpoint /zabbix.php?action=export.valuemaps is vulnerable to a Cross-Site Scripting attack due to the backurl parameter. This vulnerability arises from the reflection of user-provided data without proper HTML escaping or output encoding. As a result, a JavaScript payload may be injected into...

EUVD-2026-77439

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

Astra Linux – Vulnerability in libxml2

Possible cross-site scripting vulnerability in libxml after commit 960f0e2...

Astra Linux – Vulnerability in Sogo

There is a cross-site scripting XSS vulnerability in Alinto SOGo, version 5.12.7. A maliciously crafted ICS calendar invitation file allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue arises because the SVG content embedded in the description field of a...

Astra Linux – Vulnerability in Zabbix

A authenticated user can create a link containing reflected JavaScript code for the graphs page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...

Astra Linux – Vulnerability in Ceph

A flaw was discovered in Red Hat Ceph Storage 4, within the Dashboard component. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for documentation purposes, which again exposes them to...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory generated an HTML directory index where each file entry was rendered as a clickable link. If a file existed on the disk whose basename started with “javascript:”, such as “javascript:alert1”,...

Astra Linux – Vulnerability in rabbitmq-server

Pivotal RabbitMQ versions prior to v3.7.18, as well as RabbitMQ for PCF versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components: the virtual host limits page and the federation management UI. These components do not properly...

Astra Linux – Vulnerability in Twisted

Twisted is an event-based framework for internet applications, compatible with Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If the application code allows an attacker to control the redirect URL, this vulnerability may lead to Reflected Cross-Sit...

Astra Linux – Vulnerability in jqueryui

jQuery UI is a collection of user interface interactions, effects, widgets, and themes built upon jQuery. Versions prior to 1.13.2 may be vulnerable to cross-site scripting attacks. Initializing a checkboxradio widget within an input enclosed within a label can cause the contents of that parent...

Astra Linux – Vulnerability in python-bleach

A mutation XSS affects users who call bleachclean with any of the following tags: svg or math within the allowed tags p or br in allowed tags, style, title, noscript, script, textarea, noframes, iframe, or xmp within allowed tags. The keyword argument is stripcomments=False. Note: None of the abo...

Astra Linux – Vulnerability in Jetty9

In Eclipse Jetty versions 9.2.26 and earlier, 9.3.25 and earlier, as well as 9.4.15 and earlier, the server is vulnerable to XSS attacks if a remote client uses a specially formatted URL against the DefaultServlet or ResourceHandler that is configured to display a listing of directory contents...