10788 matches found
SUSE CVE-2025-4123
A cross-site scripting XSS vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permission...
XSS in Frontend Plugins in Grafana
A cross-site scripting XSS vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permission...
grafana -- XSS vulnerability
[email protected] reports: A cross-site scripting XSS vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does...
Yii does not prevent XSS in scenarios where fallback error renderer is used
Impact Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Patches Upgrade yiisoft/yii to version 1.1.31 or higher. References - Git commit If you have any questions or comments about this advisory, contact us through...
GHSA-7R2V-8WXR-3CH5 Yii does not prevent XSS in scenarios where fallback error renderer is used
Impact Affected versions of yiisoft/yii are vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Patches Upgrade yiisoft/yii to version 1.1.31 or higher. References - Git commit If you have any questions or comments about this advisory, contact us through...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the fallback error renderer. An attacker can manipulate the output displayed to the user by injecting malicious scripts into the input that is reflected in error messages. Note: This is only exploitable ...
CVE-2025-32027 Yii does not prevent XSS in scenarios where fallback error renderer is used
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...
CVE-2025-32027
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...
CVE-2025-32027 Yii does not prevent XSS in scenarios where fallback error renderer is used
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...
PT-2025-15994
Name of the Vulnerable Software and Affected Versions: yiisoft/yii versions prior to 1.1.31 Description: The issue concerns a Reflected XSS vulnerability in specific scenarios where the fallback error renderer is used. Recommendations: For versions prior to 1.1.31, upgrade yiisoft/yii to version...
CVE-2025-32027: Improper Neutralization of Input During Web Page Generation
Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher...
ASB-A-346797131
In ParseTag of dngifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
@excelltechkylc/code-generator (>=1.0.0, <=1.0.1), @excelltechkylc/compiler (>=1.0.0, <=1.0.1) +5 more potentially affected by CVE-2024-38985 via depath (1.0.6)
depath NPM version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on depath and may be impacted: - @excelltechkylc/code-generator =1.0.0, =1.0.0, =1.0.6, =1.0.6, =1.0.0, =1.0.4 - vitis-lowcode-renderer 1.0.0 - vitis-lowcode-simulator-renderer 1.0.0...
Improper Preservation of Consistency Between Independent Representations of Shared State
Overview Affected versions of this package are vulnerable to Improper Preservation of Consistency Between Independent Representations of Shared State which can result in two different OpenFlowNodeIds being assigned to the same SFF by different plugins. An attacker can trigger such a name conflict...
org.opendaylight.groupbasedpolicy:features-groupbasedpolicy (0.7.4), org.opendaylight.groupbasedpolicy:odl-groupbasedpolicy-neutron-and-ofoverlay (>=0.5.0-carbon, <=0.7.4) +18 more potentially affected by CVE-2025-29313 via org.opendaylight.sfc:sfc-openflow-renderer (>=0.5.0-carbon, <=0.10.4)
org.opendaylight.sfc:sfc-openflow-renderer MAVEN version =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.6.0, =0.4.0-carbon, =0.5.0, =0.4.0-carbon, =0.5.0, =0.5.2 and more Source cves: CVE-2025-29313 Source advisory:...
org.opendaylight.groupbasedpolicy:features-groupbasedpolicy (0.7.4), org.opendaylight.groupbasedpolicy:odl-groupbasedpolicy-neutron-and-ofoverlay (>=0.5.0-carbon, <=0.7.4) +17 more potentially affected by CVE-2025-29314 via org.opendaylight.sfc:odl-sfc-openflow-renderer (>=0.5.0-carbon, <=0.10.4)
org.opendaylight.sfc:odl-sfc-openflow-renderer MAVEN version =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.5.0-carbon, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.6.0, =0.4.0-carbon, =0.5.0, =0.4.0-carbon, =0.5.0, =0.5.2 and more Source cves: CVE-2025-29314 Source advisory:...
Linux Distros Unpatched Vulnerability : CVE-2022-0135
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer virglrenderer. This flaw allows a malicious guest to create a specially crafted virg...
Linux Distros Unpatched Vulnerability : CVE-2022-0175
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the VirGL virtual OpenGL renderer virglrenderer. The virgl did not properly initialize memory when allocating a host-backed memory resource....
Malicious code in storyblok-rich-text-astro-renderer-workspace (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ca413e5e4f59154a8de4096af868e37c16b2b9df85e5e20a341283c83e7b1db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
