EUVD-2026-3309

OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work...

PT-2026-3464

Name of the Vulnerable Software and Affected Versions OpenProject versions 16.3.0 through 16.6.4 Description OpenProject is a web-based project management software. A stored cross-site scripting issue exists in the Roadmap view. The issue occurs when a version contains work packages from a...

PT-2025-2647 · Unknown +1 · Otrs Community Edition +1

Name of the Vulnerable Software and Affected Versions: OTRS versions 6.0.x through 8.0.x OTRS versions 2023.x through 2024.x OTRS Community Edition version 6.0.x Description: The issue is related to the incorrect handling of HTTP request headers due to insufficient input validation, which may all...

GHSA-8FV7-WQ38-F5C9 Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to upload an arbitrary file to the content folder. Your Kirby sites are not affected if they don't allow file uploads for untrusted users ...

SUSE CVE-2014-7939

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header...

FreeBSD : Jupyter notebook -- cross-site inclusion (XSSI) vulnerability (72a6e3be-483a-11e9-92d7-f1590402501e)

Jupyter notebook Changelog : 5.7.6 contains a security fix for a cross-site inclusion XSSI vulnerability, where files at a known URL could be included in a page from an unauthorized website if the user is logged into a Jupyter server. The fix involves setting the X-Content-Type-Options: nosniff...

ownCloud: owncloud.com: Content Sniffing not disabled

URL :- https://owncloud.com Issue description :- There was no "X-Content-Type-Options" HTTP header with the value nosniff set in the response. The lack of this header causes that certain browsers, try to determine the content type and encoding of the response even when these properties are define...

Internet Bug Bounty: Wrong Handling of Content-Type allows Flash injection and Rosseta flash patch bypass

Hey, I spent some time reversing the mitigation of Rosetta Flash. This research helped me to discover a very interesting bug: Adobe Flash player uses "string searching" similar to indexOf over the entire response's "Content-Type" header value to match the "application/x-shockwave-flash" string...

chromium-browser: same-origin-bypass in V8

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header...

UBUNTU-CVE-2014-7939

Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header...

CVE-2014-7939

CVE-2014-7939 affects Google Chrome before 40.0.2214.91, where the Harmony proxy in V8 can bypass the Same Origin Policy via crafted JavaScript using Proxy.create and console.log, related to HTTP responses missing X-Content-Type-Options: nosniff. Affected component is Chrome’s V8/Chromium stack; ...