omero-figure (4.4.2), omero-iviewer (0.11.2) +4 more potentially affected by CVE-2025-54791 via omero-web (5.13.0)

omero-web PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on omero-web and may be impacted: - omero-figure 4.4.2 - omero-iviewer 0.11.2 - omero-mapr 0.4.3 - omero-parade 0.2.2 - omero-signup 0.3.1 - omero-virtual-microscope =1.1.0,...

OMERO.web displays unecessary user information when requesting password reset

BackgroundIf an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. ImpactOMERO.web before 5.29.1 PatchesUser should upgrade to 5.29.2 or higher WorkaroundsDisable the...

PYSEC-2026-1717 OMERO.web displays unecessary user information when requesting password reset

Background If an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. Impact OMERO.web before 5.29.1 Patches User should upgrade to 5.29.2 or higher Workarounds Disable t...

omero-figure (4.4.2), omero-iviewer (0.11.2) +4 more potentially affected by CVE-2024-35180 via omero-web (5.13.0)

omero-web PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on omero-web and may be impacted: - omero-figure 4.4.2 - omero-iviewer 0.11.2 - omero-mapr 0.4.3 - omero-parade 0.2.2 - omero-signup 0.3.1 - omero-virtual-microscope =1.1.0,...

PYSEC-2026-1718 OMERO.web must check that the JSONP callback is a valid function

Background There is currently no escaping or validation of the callback parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. One such endpoint is /webclient/imgData/.... As we only really use these endpoints with jQuery's own callback name generation ^1 it is quite...

GHSA-J4GV-6X9V-V23G OMERO.web uses jquery-form library, which may be vulnerable to XSS attack

Impact OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks. Patches User should upgrade OMERO.web to 5.29.3 or higher...

omero-figure (4.4.2), omero-iviewer (0.11.2) +4 more potentially affected by unknown CVE via omero-web (5.13.0)

omero-web PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on omero-web and may be impacted: - omero-figure 4.4.2 - omero-iviewer 0.11.2 - omero-mapr 0.4.3 - omero-parade 0.2.2 - omero-signup 0.3.1 - omero-virtual-microscope =1.1.0,...

OMERO.web uses jquery-form library, which may be vulnerable to XSS attack

Impact OMERO.web uses the jquery-form library throughout to handle form submission and response processing. Due to some unpatched potential vulnerabilities in jquery-form, OMERO.web 5.29.2 and earlier may be susceptible to XSS attacks. Patches User should upgrade OMERO.web to 5.29.3 or higher...

omero-figure (4.4.2), omero-iviewer (0.11.2) +4 more potentially affected by unknown CVE via omero-web (5.13.0)

omero-web PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on omero-web and may be impacted: - omero-figure 4.4.2 - omero-iviewer 0.11.2 - omero-mapr 0.4.3 - omero-parade 0.2.2 - omero-signup 0.3.1 - omero-virtual-microscope =1.1.0,...

EUVD-2025-199100

OMERO.web uses jquery-form library, which may be vulnerable to XSS attack...

EUVD-2020-0120

Malware in sbrugna...

CVE-2025-54791

OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been...

OMERO.web displays unecessary user information when requesting password reset

Background If an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. Impact OMERO.web before 5.29.1 Patches User should upgrade to 5.29.2 or higher Workarounds Disable t...

GHSA-GPMG-4X4G-MR5R OMERO.web displays unecessary user information when requesting password reset

Background If an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. Impact OMERO.web before 5.29.1 Patches User should upgrade to 5.29.2 or higher Workarounds Disable t...

omero-figure (4.4.2), omero-iviewer (0.11.2) +4 more potentially affected by CVE-2025-54791 via omero-web (5.13.0)

omero-web PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on omero-web and may be impacted: - omero-figure 4.4.2 - omero-iviewer 0.11.2 - omero-mapr 0.4.3 - omero-parade 0.2.2 - omero-signup 0.3.1 - omero-virtual-microscope =1.1.0,...

omero-figure (4.4.2), omero-iviewer (0.11.2) +4 more potentially affected by CVE-2025-54791 via omero-web (5.13.0)

omero-web PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on omero-web and may be impacted: - omero-figure 4.4.2 - omero-iviewer 0.11.2 - omero-mapr 0.4.3 - omero-parade 0.2.2 - omero-signup 0.3.1 - omero-virtual-microscope =1.1.0,...

Information Exposure

Overview omero-web is an OMERO.web Affected versions of this package are vulnerable to Information Exposure via the getGuestConnection function in the webadmin/views.py file. An attacker can obtain unnecessary user information by triggering error messages during password reset attempts. Workaroun...

omero-figure (4.4.2), omero-iviewer (0.11.2) +4 more potentially affected by CVE-2025-54791 via omero-web (5.13.0)

omero-web PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on omero-web and may be impacted: - omero-figure 4.4.2 - omero-iviewer 0.11.2 - omero-mapr 0.4.3 - omero-parade 0.2.2 - omero-signup 0.3.1 - omero-virtual-microscope =1.1.0,...

CVE-2025-54791

OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been...

omero-figure (4.4.2), omero-iviewer (0.11.2) +4 more potentially affected by CVE-2025-54791 via omero-web (5.13.0)

omero-web PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on omero-web and may be impacted: - omero-figure 4.4.2 - omero-iviewer 0.11.2 - omero-mapr 0.4.3 - omero-parade 0.2.2 - omero-signup 0.3.1 - omero-virtual-microscope =1.1.0,...