1872 matches found
CVE-2021-37860
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP...
CVE-2021-37860
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP...
Default credentials
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP...
CVE-2021-37860
Mattermost CVE-2021-37860 affects Mattermost 5.38 and earlier. The issue stems from insufficient sanitization of clipboard contents, enabling a user‑assisted attacker to inject arbitrary web script in deployments that explicitly disable the default CSP. Exploitation details are not provided in th...
CVE-2021-37860
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP...
CVE-2021-37860: Improper Neutralization of Input During Web Page Generation
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP...
GitLab: Stored XSS in merge request creation page through payload in approval rule name
Summary Hi GitLab team, I found a stored XSS in merge request creation page caused by a payload in the name of an "approval rule". Adding approval rules is a feature that is unlocked for premium subscriptions or above. This does not seem to block it from being used against regular users on for...
Ruby on Rails: Content Security Policy is only active for HTML responses but not for image/svg+xml
A vulnerability was discovered in Rails where the Content Security Policy CSP was only applied to HTML responses and not to image/svg+xml responses. This allowed an attacker to execute malicious JavaScript code by uploading a malicious SVG file and sending a link to the victim...
JetBrains Hub Encryption Issue Vulnerability
JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is capable of integrating multiple JetBrains team tools together. An encryption issue vulnerability exists in versions prior to JetBrains Hub 2021.1.13262, which stems from the fact that the CSP used by the...
Security Misconfiguration☝️ — What you need to know
Security Misconfiguration☝️ — What you need to know Introduction API7:2019 Security Misconfiguration What is Security Misconfiguration? There are several factors that might indicate a Security Misconfiguration. We should be very careful with handling configurations because if the correct security...
Cloud Security Glossary: Key Terms and Definitions
When navigating the complexities of the public cloud, it’s easy to get lost in the endless acronyms, industry jargon, and vendor-specific terms. From K8s to IaC to Shift Left, it can be helpful to have a map to navigate the nuances of this emerging segment of the market. That’s why a few cloud...
CVE-2021-37540
In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...
CVE-2021-37540
CVE-2021-37540 affects JetBrains Hub prior to 2021.1.13262, where the Widget deployment feature used a potentially insufficient CSP. Multiple sources (Red Hat, CNVD, PRION/PT-Security, NVD/NVD list) confirm the issue name and affected version range. The JetBrains Security Bulletin Q2-2021 notes t...
CVE-2021-37540
In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...
CVE-2021-37540: Undefined Security Weakness
In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used...
GitLab: Stored XSS in main page of a project caused by arbitrary script payload in group "Default initial branch name"
Summary A stored XXS exists in the main page of a project. By changing the "default branch name" of a group a malicious user can inject arbitrary JavaScript into the main page of a project. Any user that is either at least developer of the project, or an administrator of the GitLab instance, and...
WS-2021-0161
In authelia, versions v4.0.0 to v4.14.2 are vulnerable due to insufficient policy enforcement in CSP. Specific inline scripts are not ‘whitelisted’ using a unique nonce. The absence of a nonce means that modern browsers will not ignore 'unsafe-inline' leading to unwanted execution of javascript o...
SUSE: Security Advisory (SUSE-SU-2014:0248-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2016:3210-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...