481 matches found
CVE-2024-32469 Decidim has cross-site scripting (XSS) in the pagination
Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter perpage. This vulnerability is fixed in 0.27.6 and 0.28.1...
CVE-2024-32469
Decidim core/package suffers an XSS vulnerability in pagination via the GET parameter per_page. Affected versions include older Decidim releases; the issue is mitigated by upgrading to at least 0.27.6 or 0.28.1 (or higher). Public docs from Red Hat, GitHub advisories, and CVE references confirm t...
CVE-2024-32469 Decidim has cross-site scripting (XSS) in the pagination
Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter perpage. This vulnerability is fixed in 0.27.6 and 0.28.1...
GHSA-7CX8-44PC-XV3Q Decidim cross-site scripting (XSS) in the pagination
Impact The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter perpage. Patches Not available Workarounds Not available References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized...
Decidim cross-site scripting (XSS) in the pagination
Impact The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter perpage. Patches Not available Workarounds Not available References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the pagination feature used in searches and filters by injecting a malformed URL into the GET parameter perpage Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the pagination feature used in searches and filters by injecting a malformed URL into the GET parameter perpage Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker...
PT-2024-24596 · Decidim · Decidim
Name of the Vulnerable Software and Affected Versions: Decidim versions prior to 0.27.6 Decidim versions prior to 0.28.1 Description: The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter per page. This issue was...
Decidim cross-site scripting (XSS) in the pagination
Impact The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter perpage. Patches Patched in version 0.27.6 and 0.28.1 References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized by...
Virtuozzo Hybrid Infrastructure 6.2 (6.2.0-136)
In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover the compute service, high availability of the management node, object storage management, networking, and monitoring. Additionally, this release delivers stability improvements and addresses issues found ...
CVE-2024-4623
The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘paginationstyle’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
CVE-2024-4623 Blogmentor – Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter
The Blogmentor – Blog Layouts for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘paginationstyle’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...
WordPress plugin Blogmentor security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
Duplicate users when using pagination(start,limit parameter) in GET /rest/api/user/list REST API call.
h3. Issue Summary When paginationstart, limit parameter is used in a GET /rest/api/user/list REST API call, duplicate users are observed. This is reproducible on Data Center: yes h3. Steps to Reproduce On a Confluence instance with multiple users from external and internal directories, run the...
CVE-2024-32978 Kaminari Insecure File Permissions Vulnerability
Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified in the Kaminari pagination library for Ruby on Rails, concerning insecure file permissions. This vulnerability is of moderate severity du...
CVE-2024-32978
CVE-2024-32978 affects the Kaminari pagination library for Ruby on Rails, via insecure file permissions that could allow unauthorized write access to specific Ruby files. The published guidance specifies upgrading to Kaminari 0.16.2 or later, where file permissions were adjusted to improve securi...
CVE-2024-32978 Kaminari Insecure File Permissions Vulnerability
Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified in the Kaminari pagination library for Ruby on Rails, concerning insecure file permissions. This vulnerability is of moderate severity du...
Joomla core 3.0.0-3.10.16-elts,4.0.0-4.4.6,5.0.0-5.1.2 - Unauthenticated Cache Poisoning in Pagination vulnerability
Unauthenticated Cache Poisoning in Pagination vulnerability discovered by ? in WordPress Core Joomla versions 3.0.0-3.10.16-elts,4.0.0-4.4.6,5.0.0-5.1.2...
