Improper rendering of text nodes in golang.org/x/net/html

...

Cross-Site Scripting (XSS)

github.com/golang/net is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape user input in text nodes outside the HTML namespace, allowing an attacker to inject and execute malicious JavaScript on a victim's browser...

AZL-34542 CVE-2023-3978 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-43555 CVE-2023-3978 affecting package podman 4.1.1-26

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-42867 CVE-2023-3978 affecting package multus for versions less than 4.0.2-2

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-34907 CVE-2023-3978 affecting package kubevirt for versions less than 1.2.0-1

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-27813 CVE-2023-3978 affecting package kubevirt for versions less than 0.59.0-24

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-31858 CVE-2023-3978 affecting package multus for versions less than 4.0.2-5

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

CVE-2023-3978

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Kafka nodes are vulnerable to denial of service due to [CVE-2023-34453], [CVE-2023-34454], [CVE-2023-34455]

Summary Java component snappy-java is used by Kafka in IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Kafka nodes are vulnerable to denial of service. This bulletin provides patch informatio...

Insufficient input sanitization on Windows nodes leads to privilege escalation

CVSS Rating: CVSS:3.1/av:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 8.8 A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Am...

Insufficient input sanitization on kubernetes-csi-proxy leads to privilege escalation

CVSS Rating: CVSS:3.1/av:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 8.8 A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if...

B&R Industrial Automation GmbH Runtime 安全漏洞

B&R Industrial Automation GmbH Runtime is a major component of the AS from B&R Industrial Automation, Austria. A security vulnerability exists in B&R Industrial Automation GmbH Runtime versions prior to G4.93, which stems from an improper initialization issue that results in multiple services bei...

Google Nest 授权问题漏洞

Google Nest is a smart home product by Google, an American company. Google Nest has a security vulnerability. The vulnerability allows unauthenticated nodes to forge radio frames using "Key ID Mode 2", a special mode that uses a static encryption key to bypass security checks, allowing arbitrary ...

Progress Software Chef Infra Server 安全漏洞

Progress Software Chef Infra Server is an application from Progress Software, Inc. It is used to act as a hub for configuration data. A security vulnerability exists in Progress Software Chef Infra Server versions prior to 15.7, which stems from a vulnerability that allows a local attacker to...

Insufficient input sanitization on Windows nodes leads to privilege escalation

CVSS Rating: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 8.8 A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Am...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a kubelet security vulnerability (CVE-2023-2431)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the kubelet that allows pods to bypass the seccomp profile enforcement CVE-2023-2431 Vulnerability Details CVEID: CVE-2023-2431 Description: Kubernetes could allow a local authenticated attacker to bypass security...

GHSA-F475-JGG3-3JWC Apache InLong Exposure of Resource to Wrong Sphere vulnerability

Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apache InLong 1.7.0 or cherry-pick...

GHSA-3FQM-FRHG-7C85 Graylog user session is still usable after logout

Summary In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Details Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the...

PT-2023-24392 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Foxy Fitzroy versions where ROS VERSION is 2 and ROS PYTHON VERSION is 3 Description: An unauthorized access issue has been discovered, potentially allowing a malicious user to gain unauthorized access to multiple ROS2 nodes remotely. Th...