2423 matches found
CVE-2020-36307
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...
CVE-2020-36307
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...
Cross site scripting
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...
CVE-2020-36307
Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links...
CVE-2020-36307
CVE-2020-36307 affects Redmine before 4.0.7 and Redmine 4.1.x before 4.1.1, with a stored XSS flaw via textile inline links. Several connected sources corroborate the vulnerability as a stored cross‑site scripting issue in Redmine’s web UI. Debian LTS advisories cite a patched Redmine version (3....
PT-2021-4536 · Redmine · Redmine
Name of the Vulnerable Software and Affected Versions: Redmine versions 4.0.0 through 4.0.6 Redmine versions 4.1.0 through 4.1.0 Description: The issue is related to stored XSS via textile inline links, which can be exploited by a remote attacker to impact data integrity. The vulnerability is due...
GitLab: RCE via unsafe inline Kramdown options when rendering certain Wiki pages
Summary When rendering wiki content with certain extensions such as .rmd, renderwikicontent will call othermarkupunsafe which will end up calling GitHub::Markup.render from the github-markup gem. Files with any extension can be uploaded by checking out the wiki with git, commiting the files and...
bind security update
32:9.11.4-26.P2.4 - Fix off-by-one bug in ISC SPNEGO implementation CVE-2020-8625 32:9.11.4-26.P2.3 - Fix inline re-signing rh1889902 32:9.11.4-26.P2.2 - Fix unsupported algorithms validation rh1769876 32:9.11.4-26.P2.1 - Fix tsig-request verify CVE-2020-8622 - Prevent PKCS11 daemon crash on...
CVE-2021-1730
A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user. This update addresses this vulnerability. To prevent these types of attacks, Microsoft recommends customers to download inline images from...
CVE-2021-1730
A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user. This update addresses this vulnerability. To prevent these types of attacks, Microsoft recommends customers to download inline images from...
Arbitrary JavaScript Execution
Overview In affected versions of less-openui5 processing untrusted theming resources might execute arbitrary code. Impact When processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be...
CVE-2021-21316
less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources i.e. .less files with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be execut...
openSUSE Security Update : gcc7 (openSUSE-2020-2301)
This update for gcc7 fixes the following issues : - CVE-2020-13844: Added mitigation for aarch64 Straight Line Speculation issue bsc1172798 - Enable fortran for the nvptx offload compiler. - Update README.First-for.SuSE.packagers - avoid assembler errors with AVX512 gather and scatter instruction...
Inline JS XSS vulnerability in Mautic
Impact Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form. Patches Upgrade to 2.12.0 or later. Workarounds None References https://github.com/mautic/mautic/releases/tag/2.12.0 For mo...
OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-03043)
OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker could exploit this vulnerability via an inline image with a specially crafted...
OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-03042)
OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.4. An attacker could exploit this vulnerability via an inline binary to conduct a cross-site...
CVE-2021-23931
OX App Suite through 7.10.4 allows XSS via an inline binary file...
CVE-2021-23932
OX App Suite through 7.10.4 allows XSS via an inline image with a crafted filename...