https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 ニュージャージー州公式サイトの脆弱性レポート Bootstrap 4.0.0 発見場所: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js 脆弱性情報: 中 28236 tooltip/popover の data-template、data-content、data-title プロパティにおける XSS CVE-2019-8331 3.x 系では 3.4.1 より前、4.x 系では 4.3.1 より前のバージョンの Bootstrap...

CVE-2019-8331

英文 说明 CVE-2019-8331 是 Bootstrap 中的一个跨站脚本（XSS）安全漏洞。Bootstrap 是一个广泛用于网站和移动应用开发的 JavaScript 库。该漏洞是由于 Bootstrap 未能正确过滤随 tooltip 或 popover 元素的 data-template 属性传入的数据所致，使攻击者能够将恶意代码注入网页。 如果攻击者能够控制将显示为 tooltip 或 popover 的数据，就可能发生此类攻击。当用户触发 tooltip 或 popover 时，恶意代码会被注入网页，并可能在用户浏览器中执行。 此漏洞已在 Bootstrap 4.3.1...

GHSA-RF84-WR5G-M3RP CAPM3 vulnerable to Cross-Namespace resource access

Summary CAPM3 is Metal3's Cluster API CAPI provider for baremetal provisioning in Kubernetes. Multiple cross-namespace access control vulnerabilities in Cluster API Provider Metal3 allow users with permissions to create or modify CAPM3 resources in one namespace to reference, read, or claim...

PT-2026-47580

Summary CAPM3 is Metal3's Cluster API CAPI provider for baremetal provisioning in Kubernetes. Multiple cross-namespace access control vulnerabilities in Cluster API Provider Metal3 allow users with permissions to create or modify CAPM3 resources in one namespace to reference, read, or claim...

UBUNTU-CVE-2026-48683

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflowplugin/netflowv9collector.cpp, the Data template branch lines 1695-1702 iterates over flow records without performing a per-iteration bounds check agains...

CVE-2026-48683

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflowplugin/netflowv9collector.cpp, the Data template branch lines 1695-1702 iterates over flow records without performing a per-iteration bounds check agains...

PT-2026-43270

Name of the Vulnerable Software and Affected Versions FastNetMon Community Edition versions prior to 1.2.10 Description An out-of-bounds read exists in the NetFlow v9 data flowset processor within the src/netflow plugin/netflow v9 collector.cpp file. The Data template branch iterates over flow...

CVE-2026-48683

FastNetMon Community Edition versions through 1.2.9 are vulnerable to an out-of-bounds read in the NetFlow v9 data flowset processor . The root cause is located in src/netflow_plugin/netflow_v9_collector.cpp, where the Data template branch (lines 1695-1702) fails to perform a per-iteration bounds...

EUVD-2026-31839

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflowplugin/netflowv9collector.cpp, the Data template branch lines 1695-1702 iterates over flow records without performing a per-iteration bounds check agains...

CVE-2026-48683

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflowplugin/netflowv9collector.cpp, the Data template branch lines 1695-1702 iterates over flow records without performing a per-iteration bounds check agains...

CVE-2026-48683

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflowplugin/netflowv9collector.cpp, the Data template branch lines 1695-1702 iterates over flow records without performing a per-iteration bounds check agains...

CVE-2026-29207

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with...

EUVD-2026-30855

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with...

CVE-2024-10753

A vulnerability was found in PHPGurukul Online Shopping Portal 2.0. It has been declared as problematic. This vulnerability affects unknown code of the file admin/assets/plugins/DataTables/media/unittesting/templates/domdatatwoheaders.php. The manipulation of the argument scripts leads to cross...

RHEL 8 : bootstrap (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - bootstrap: XSS in the tooltip or popover data-template attribute CVE-2019-8331 - In Bootstrap 3.x before...

SUSE CVE-2019-8331

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute...

Fedora 38 : cacti / cacti-spine (2023-6335ea9c0c)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-6335ea9c0c advisory. Update cacti and cacti-spine to version 1.2.25. This includes the upstream fixes for many CVEs...

CVE-2023-39514

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

Cross site scripting

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2023-39514 Stored Cross-site Scripting on graphs.php data template formated name view in Cacti

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...