Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Summary When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transformed output by supplying a...

Cross-site Scripting (XSS)

vite is vulnerable to Cross-Site Scripting. This vulnerability exists because it does not properly sanitize inline scripts in the server.transformIndexHtml function, allowing an attacker to inject and execute malicious JavaScript into the browser. This vulnerability is only exploitable if the...

Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Request Tracker vulnerabilities (USN-6529-1)

The remote Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6529-1 advisory. It was discovered that Request Tracker incorrectly handled certain inputs. If a user or an automated system were...

CVE-2023-48306

CVE-2023-48306 affects Nextcloud Server and Nextcloud Enterprise Server due to a DNS pin middleware vulnerability that enables DNS rebinding and SSRF. The issue is fixed in Nextcloud Server in versions 25.0.11, 26.0.6, and 27.1.0, and in Nextcloud Enterprise Server in 22.2.10.16, 23.0.12.11, 24.0...

CVE-2023-48306 Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and starting in version 22.0.0 and prior to versions 22.2.10.16, 23.0.12.11, 24.0.12.7, 25.0.11, 26.0.6, and 27.1.0...

DNS pin middleware can be tricked into DNS rebinding allowing SSRF

None...

GHSA-V64W-49XW-QQ89 Possible user mocking that bypasses basic authentication

Impact next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the...

Possible user mocking that bypasses basic authentication

Impact next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth sign-in flow state, PKCE or nonce. Manually overriding the...

Design/Logic Flaw

NextAuth.js provides authentication for Next.js. next-auth applications prior to version 4.24.5 that rely on the default Middleware authorization are affected by a vulnerability. A bad actor could create an empty/mock user, by getting hold of a NextAuth.js-issued JWT from an interrupted OAuth...

CVE-2023-48309

Concrete details: The CVE-2023-48309 flaw affects next-auth (Next.js) apps before v4.24.5 that rely on the default Middleware authorization. An attacker can obtain a NextAuth.js JWT from an interrupted OAuth sign-in flow and override the next-auth.session-token cookie with this unrelated JWT to s...

Oracle Business Process Management Suite (Oct 2023 CPU)

The version of Oracle Business Process Management Suite installed on the remote host is affected by multiple vulnerabilities, as referenced in the October 2023 CPU advisory. Specifically: - Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware component...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-36584 Microsoft Windows Mark of the Web MOTW Security Feature Bypass Vulnerability CVE-2023-1671 Sophos Web Appliance Command Injection Vulnerability...

Oracle Fusion Middleware Unspecified Vulnerability

Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server...

Critical: Red Hat Security Advisory: security update jboss-amq-6/amq63-openshift container image

Red Hat AMQ 6.3 container image is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Critical: Red Hat Security Advisory: jboss-amq-6-amq63-openshift-container security update

An update for jboss-amq-6-amq63-openshift-container is now available for RHEL-7 based Middleware Containers. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Fedora 39 : golang-github-prometheus-alertmanager (2023-0c6723004f)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0c6723004f advisory. Automatic update for golang-github-prometheus-alertmanager-0.23.0-15.fc39. Changelog Sat Apr 29 2023 Srgio M. Basto - 0.23.0-15 - Include s390x, and disable...

The vulnerability of the NextGen Installer component affects the software platform Oracle Fusion Middleware’s NextGen OUI Framework. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the NextGen Installer component of the Oracle Global Lifecycle Management NextGen OUI Framework software platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity, and...

Chain Halt

github.com/cosmos/packet-forward-middleware is vulnerable to a Chain Halt. The vulnerability exists because it does not properly validate IBC packets in the incoming router, allowing an attacker to cause a chain halt...

Cosmos packet-forward-middleware vulnerable to chain-halt

The Cosmos SDK is used for Inter-Blockchain Communication Protocol IBC applications and middleware. The packet-forward-middleware module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destinatio...

GHSA-W6RP-VXJ2-FJHR Cosmos packet-forward-middleware vulnerable to chain-halt

The Cosmos SDK is used for Inter-Blockchain Communication Protocol IBC applications and middleware. The packet-forward-middleware module is an IBC middleware module built for Cosmos blockchains utilizing the IBC protocol allowing routing of incoming IBC packets from a source chain to a destinatio...