Chisel's AUTH environment variable not respected in server entrypoint

Summary The Chisel server doesn't ever read the documented AUTH environment variable used to set credentials, which allows any unauthenticated user to connect, even if credentials were set. This advisory is a formalization of a report sent to the maintainer via email. Details In the help page for...

Exploit for Incorrect Privilege Assignment in Litespeedtech Litespeed_Cache

CVE-2024-28000 PoC This repository contains tools for exploit...

Citrix Endpoint Management (aka XenMobile Server) 10.16.0 Rolling Patch 3

Package name: xms10.16.0.10318.bin For: XenMobile Server 10.16.0 Deployment type: On-premises only Replaces: xms10.16.0.10205.bin, xms10.16.0.10108.bin Date: August 2024 Languages supported: English US Important notes about this update As a best practice, Citrix recommends that you install this a...

[SECURITY] Fedora 40 Update: python3-docs-3.12.5-1.fc40

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

[SECURITY] Fedora 39 Update: python3-docs-3.12.5-1.fc39

The python3-docs package contains documentation on the Python 3 programming language and interpreter...

Fedora 39 : python3-docs / python3.12 (2024-ce1992d46f)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-ce1992d46f advisory. Update to 3.12.5 Fixes CVE-2024-6923 email header injection Tenable has extracted the preceding description block directly from the Fedora security advisory...

Fedora: Security Advisory (FEDORA-2024-ce1992d46f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-80d1fe51d0)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to priviledge escalation [CVE-2022-43915]

Summary IBM App Connect Enterprise Certified Container operands are vulnerable to privilege escalation due to not limiting the unshare command. This bulletin provides patch information to address the reported vulnerability. CVE-2022-43915 Vulnerability Details CVEID:CVE-2022-43915 DESCRIPTION: IB...

BIT-AIRFLOW-2024-41937 Apache Airflow: Stored XSS Vulnerability on provider link

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.13.48 packages and security update

Red Hat OpenShift Container Platform release 4.13.48 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

Cross Site Scripting(XSS)

apacheairflow is vulnerable to a Cross Site ScriptingXSS. The vulnerability is due to the ability of a malicious provider to execute a script when a user clicks on a provider documentation link in docs.py and provided the provider is installed on the web server, which allows an attacker to exploi...

PYSEC-2024-181

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and theuser to click the provid...

CVE-2024-41937

The CVE concerns Apache Airflow versions before 2.10.0, where a stored XSS vulnerability exists in the provider link workflow. If a malicious provider is installed on the web server, a user who clicks a provider documentation link can trigger script execution, enabling an attacker to perform a cr...

CVE-2024-41937 Apache Airflow: Stored XSS Vulnerability on provider link

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the...

CVE-2024-41937

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the...

CVE-2024-41937: Improper Neutralization of Input During Web Page Generation

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This would require the provider to be installed on the web server and the user to click the...

PT-2024-29645 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.10.0 Description: The issue allows the developer of a malicious provider to execute a cross-site scripting attack when clicking on a provider documentation link. This requires the provider to be installed on...

CVE-2024-43408

Discourse Placeholder Forms will let you build dynamic documentation. Unsanitized and stored user input was injected in the html of the post. The vulnerability is fixed in commit a62f711d5600e4e5d86f342d52932cb6221672e7...

CVE-2024-43408

CVE-2024-43408 concerns the Discourse Placeholder Forms feature. The issue arises from unsanitized and stored user input being injected into the HTML of a post, enabling vulnerable dynamic content rendering. The vulnerability is associated with the placeholder forms component and is described as ...