PT-2024-25145 · Sailpoint · Sailpoint Identity Security Cloud

Name of the Vulnerable Software and Affected Versions: SailPoint Identity Security Cloud affected versions not specified Description: An issue was identified in the Identity Security Cloud ISC Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator ...

NocoDB Allows Preview of Files with Dangerous Content

Summary --- Attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading Stored XSSCross-Site Script attack. PoC --- NocoDB was configured using the Release Binary Noco-macos-arm64, and nocodb version 0.202.9 currentl...

GHSA-QG73-G3CF-VHHH NocoDB Allows Preview of Files with Dangerous Content

Summary --- Attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading Stored XSSCross-Site Script attack. PoC --- NocoDB was configured using the Release Binary Noco-macos-arm64, and nocodb version 0.202.9 currentl...

CVE-2023-50717 NocoDB Allows Preview of File with Dangerous Content

NocoDB is software for building databases as spreadsheets. Starting in verson 0.202.6 and prior to version 0.202.10, an attacker can upload a html file with malicious content. If user tries to open that file in browser malicious scripts can be executed leading stored cross-site scripting attack...

Cross-Site Scripting

libSOGo.so is vulnerable to Cross-Site Scripting. The vulnerability is due to inadequate sanitization during attachment preview. This allows an attacker to execute arbitrary JavaScript code within the context of the user's browser session...

DEBIAN-CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

UBUNTU-CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

PT-2024-25916

Name of the Vulnerable Software and Affected Versions Alinto SOGo versions through 5.10.0 Description The issue allows for XSS during attachment preview. Recommendations For versions through 5.10.0, update to a version later than 5.10.0 to resolve the issue. At the moment, there is no information...

SOGo 安全漏洞

SOGo is a very fast and extensible modern collaboration suite. It provides calendaring, address book management and a full-featured Webmail client as well as resource sharing and permission handling. A security vulnerability exists in Alinto SOGo 5.10.0 and prior versions that originates from...

CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

CVE-2024-34462

Alinto SOGo through 5.10.0 allows XSS during attachment preview...

CVE-2024-34462

CVE-2024-34462 affects Alinto SOGo up to version 5.10.0, enabling Cross-Site Scripting during attachment previews. The incident is documented across multiple feeds (NVD, OSV, Debian LTS DLA-4434) with Debian noting a patch in 5.0.1-4+deb11u3 for the Bullseye release. In practice, affected deploym...

PT-2024-18440 · WordPress · Arforms Form Builder

Name of the Vulnerable Software and Affected Versions: ARForms Form Builder plugin for WordPress versions up to, and including, 1.6.4 Description: The issue is related to a missing capability check on the arflite remove preview data function, allowing authenticated attackers with subscriber acces...

Debian dla-3801 : emacs - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3801 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3801-1 [email protected]...

[BSA-119] Security Update for emacs

Sean Whitton uploaded new packages for emacs which fixed the following security problems: CVE-2024-30202 In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. CVE-2024-30203 believed bogus, request submitted to MITRE to merge...

Explorer for Microsoft Teams: "System event messages are unsupported."

Challenge When exploring Teams channel messages, some messages are listed with an empty Author and Subject value. Attempting to preview one of these messages causes the following warning to be displayed: System event messages are unsupported. Cause This warning occurs because system messages cann...

Popup Anything < 2.8.1 - Missing Authorization

Description The Popup Anything – Popup for opt-ins and Lead Generation Conversions plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the popupaocrenderpopuppreview function in all versions up to, and including, 2.8.0. This makes it possible for...