CVE-2020-13673

CVE-2020-13673 affects the Drupal core Media module, where a filter for embedding media in content fields can let an unprivileged user inject HTML when viewed by a privileged user, enabling cross-site scripting. The issue is documented by NVD as a XSS risk via the media embedding filter. Remediat...

CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...

CVE-2020-13673: Cross-Site Request Forgery (CSRF)

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3974 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.54)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2020-11996 Source...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-11996 Source advisory: GHSA-53HP-JPWQ-2JGQ...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-11996 Source advisory: OSV:GHSA-53HP-JPWQ-2JGQ...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +4087 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.34)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2020-11996 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +4087 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.34)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2020-11996 Source...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3974 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.54)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2020-11996 Source...

GHSA-MV26-CX23-VRFG Server-Side Request Forgery in @peertube/embed-api

@peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery...

Server-Side Request Forgery in @peertube/embed-api

@peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22) potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version 10.0.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-websocket and may be impacted: - nz.net.osnz.composite:composite-spring-boot-tomcat 5.22 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +4357 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.0.m18, <=9.0.36)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.0.m18, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2020-13935...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +4357 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=9.0.0.m18, <=9.0.36)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =9.0.0.m18, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2020-13935...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3410 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=8.5.4, <=8.5.56)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =8.5.4, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2020-13935 Source...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22) potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version 10.0.0-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-websocket and may be impacted: - nz.net.osnz.composite:composite-spring-boot-tomcat 5.22 Source...

ch.rasc:embeddedtc (>=1.13, <=1.29), ch.rasc:embeddedtc-maven-plugin (>=1.11, <=1.23) +63 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=7.0.52, <=7.0.94)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =7.0.52, =1.13, =1.11, =2.0.19, =0.15.0, =1.0.0, =1.0.0, =1.0.8, =0.3.0, =0.4.0, =0.2.0, =0.1.0, =0.3.0 and more Source cves: CVE-2020-13935 Source advisory: OSV:GHSA-M7JV-HQ7H-MQ7C...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3410 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=8.5.4, <=8.5.56)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =8.5.4, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2020-13935 Source...

ch.rasc:embeddedtc (>=1.13, <=1.29), ch.rasc:embeddedtc-maven-plugin (>=1.11, <=1.23) +63 more potentially affected by CVE-2020-13935 via org.apache.tomcat.embed:tomcat-embed-websocket (>=7.0.52, <=7.0.94)

org.apache.tomcat.embed:tomcat-embed-websocket MAVEN version =7.0.52, =1.13, =1.11, =2.0.19, =0.15.0, =1.0.0, =1.0.0, =1.0.8, =0.3.0, =0.4.0, =0.2.0, =0.1.0, =0.3.0 and more Source cves: CVE-2020-13935 Source advisory: GHSA-M7JV-HQ7H-MQ7C...

PT-2022-13226

Name of the Vulnerable Software and Affected Versions @peertube/embed-api versions prior to Not released yet @peertube/embed-api version 4.0.0 and prior Description The issue is related to Server-Side Request Forgery SSRF in the @peertube/embed-api. Recommendations For @peertube/embed-api version...