CVE-2025-54588 Envoy: Race condition in Dynamic Forward Proxy leads to use-after-free and segmentation faults

Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. Versions 1.34.0 through 1.34.4 and 1.35.0 contain a use-after-free UAF vulnerability in the DNS cache, causing abnormal process termination. The vulnerability is in Envoy's Dynamic...

Malicious code in component-dfp (npm)

The package component-dfp was found to contain malicious code...

MAL-2025-17455 Malicious code in component-dfp (npm)

The package component-dfp was found to contain malicious code...

Doubleclick for Publishers (DFP) - Moderately critical - Cross site scripting - SA-CONTRIB-2022-035

Doubleclick for Publishers DFP module enables a site to place ads from Doubleclick For Publishers. The module doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting XSS vulnerabilities. An attacker that can create or edit certain entities may be able to exploit a...

PT-2022-38350

Doubleclick for Publishers DFP module enables a site to place ads from Doubleclick For Publishers. The module doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting XSS vulnerabilities. An attacker that can create or edit certain entities may be able to exploit a...

Doubleclick for Publishers (DFP) - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-002

This module enables you to to place advertisements on your site that are served by Google's DFP Doubleclick for Publisher service. The module has multiple Cross Site Scripting XSS vulnerabilities due to not sufficiently escaped fields. The "administer DFP" permission is not marked as restricted...

CVE-2014-8748

Cross-site scripting XSS vulnerability in the Google Doubleclick for Publishers DFP module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name...

CVE-2014-8748

CVE-2014-8748 is a Drupal DFP (Doubleclick for Publishers) module XSS vulnerability in the 7.x-1.x line, where unsanitized slot names output to HTML allows remote authenticated users with the administer dfp permission to inject arbitrary script or HTML. The affected versions are DFP 7.x-1.x prior...

PT-2014-8707

Name of the Vulnerable Software and Affected Versions Google Doubleclick for Publishers DFP module versions 7.x-1.x before 7.x-1.2 Description The issue allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name, which is a...

CVE-2014-8748: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Google Doubleclick for Publishers DFP module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name...

SA-CONTRIB-2014-003 - Doubleclick for Publishers DFP - Cross Site Scripting (XSS)

This module enables you to create blocks to place advertisements from the Google Double Click for Publishers API DFP. The module doesn't sufficiently sanitize the slot names prior to output into HTML. This vulnerability is mitigated by the fact that an attacker must have a role with the permissio...