OESA-2025-2168 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP respons...

OESA-2025-2172 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP respons...

OESA-2025-2169 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP respons...

OESA-2025-2171 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP respons...

CVE-2025-8684 Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

WordPress plugin Biagiotti Core 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2025-36108

Name of the Vulnerable Software and Affected Versions: Flatsome Theme for WordPress versions prior to 3.20.0 Description: The Flatsome Theme for WordPress is susceptible to Stored Cross-Site Scripting through its shortcodes. This is due to inadequate input sanitization and output escaping of...

Linux Distros Unpatched Vulnerability : CVE-2024-38274

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. CVE-2024-38274 Note that Nessus relies on the presenc...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataPagename parameter in the /apprain/page/manage-static-pages/create process. An attacker can execute arbitrary JavaScript code in the context of a user's browser by submitting crafted input that is...

Errors returned from JSON marshaling may break template escaping in html/template

...

USN-7648-3 php7.0, php7.2, php7.4 regression

USN-7648-2 fixed vulnerabilities in PHP. The patch for CVE-2025-1735 caused a regression in php7.0, php7.2 and php7.4. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that PHP incorrectly handled certain hostnames containing null...

USN-7648-3: PHP regression

USN-7648-2 fixed vulnerabilities in PHP. The patch for CVE-2025-1735 caused a regression in php7.0, php7.2 and php7.4. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that PHP incorrectly handled certain hostnames containing null...

Cross-site Scripting (XSS)

Overview streamlit-shortcuts is a Streamlit keyboard shortcuts for your buttons. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addshortcuts function which fails to properly escape special characters when injecting JavaScript code into the DOM. Details...

Oracle Linux 8 : httpd:2.4 (ELSA-2025-15123)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-15123 advisory. - Resolves: RHEL-99944 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade - Resolves: RHEL-99969 - CVE-2024-47252 httpd: insufficient...

CVE-2023-3666

The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Linux Distros Unpatched Vulnerability : CVE-2021-40694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account. CVE-2021-40694...

httpd: insufficient escaping of user-supplied data in mod_ssl

A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...

RHEL 7 : httpd (RHSA-2025:14997)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:14997 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: insufficient...

Oracle Linux 9 : httpd (ELSA-2025-15023)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-15023 advisory. - Resolves: RHEL-99949 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade - Resolves: RHEL-99972 - CVE-2024-47252 httpd: insufficient...

WordPress TablePress Plugin Cross-Site Scripting Vulnerability

WordPress TablePress Plugin is a table plugin designed for WordPress that allows users to create, edit, and manage tables without programming, with support for multiple data types and interactive features. WordPress TablePress Plugin suffers from a cross-site scripting vulnerability that stems fr...