CVE-2024-2380

Stored XSS in graph rendering in Checkmk 2.3.0b4...

CVE-2024-2380 XSS in graph rendering

Stored XSS in graph rendering in Checkmk 2.3.0b4...

CVE-2024-2380 XSS in graph rendering

Stored XSS in graph rendering in Checkmk 2.3.0b4...

CVE-2024-2380

CVE-2024-2380 affects Checkmk prior to version 2.3.0b4, with a stored XSS vulnerability in the graph rendering component. The root cause is an XSS flaw in how graphs are rendered, potentially allowing an attacker to inject script via graph data. Mitigation is to upgrade to 2.3.0b4 or later (per d...

PT-2024-20091 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0b4 Description: The issue is related to stored XSS in graph rendering. Recommendations: For versions prior to 2.3.0b4, update to version 2.3.0b4 or later to resolve the issue...

PT-2024-23672 · Derbynet · Derbynet

Name of the Vulnerable Software and Affected Versions: DerbyNet version 9.0 Description: The issue allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering. This is a SQL Injection vulnerability. Recommendations: For DerbyNet version 9.0, consider...

PT-2024-23673 · Derbynet · Derbynet

Name of the Vulnerable Software and Affected Versions: DerbyNet versions 9.0 and below Description: The issue allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering. This is a SQL Injection vulnerability. Recommendations: For DerbyNet versions 9.0 and...

DerbyNet 9.0 print/render/racer.inc SQL Injection

CVE ID: CVE-2024-30923 Description: An SQL Injection vulnerability has been discovered in DerbyNet version 9.0, specifically within the print/render/racer.inc component. This vulnerability allows remote attackers to execute arbitrary code and disclose sensitive information by exploiting improper...

CVE-2024-25697

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when opening an authenticated users bio page will render an image in the victims browser. The privileges required to execute...

CVE-2024-25696

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser. The privileges required to execute this attack...

CVE-2024-25696 Stored XSS in Portal for ArcGIS

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser. The privileges required to execute this attack...

CVE-2024-25697

Summary: CVE-2024-25697 is a stored cross-site scripting issue in Portal for ArcGIS (versions 11.1 and below) where a crafted link, triggered by an authenticated user viewing a bio page, can cause an image to render in the victim’s browser. The attack requires low privileges and authenticated acc...

PT-2024-21094 · Esri · Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Portal for ArcGIS versions =11.0 Description: The issue is related to a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link. When the victim accesses the page editor, an image will rende...

Fedora: Security Advisory for webkitgtk (FEDORA-2024-f1ae7b7ac5)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2023-52632

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix lock dependency warning with srcu ====================================================== WARNING: possible circular locking dependency detected 6.5.0-kfd-yangp 2289 Not tainted...

[SECURITY] Fedora 38 Update: webkitgtk-2.44.0-2.fc38

WebKitGTK is the port of the WebKit web rendering engine to the GTK platform...

Medium: python-pillow

Issue Overview: An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw...

PT-2024-23117 · Unknown · Astro-Shield

Name of the Vulnerable Software and Affected Versions: Astro-Shield versions prior to 1.3.0 Description: Astro-Shield is a library used to compute subresource integrity hashes for JavaScript scripts and CSS stylesheets. When automated Content Security Policy CSP headers generation for Server-Side...

DEBIAN-CVE-2023-45913

Mesa v23.0.4 was discovered to contain a NULL pointer dereference via the function dri2GetGlxDrawableFromXDrawableId. This vulnerability is triggered when the X11 server sends an DRI2BufferSwapComplete event unexpectedly when the application is using DRI3. NOTE: this is disputed because there is ...

X11 Mesa 3D Graphics Library 安全漏洞

X11 Mesa 3D Graphics Library is a 3D graphics library. A security vulnerability exists in X11 Mesa 3D Graphics Library version 23.0.4, which stems from glxpbuffer.c was found to contain a segmentation conflict vulnerability in a call to glXGetDrawableAttribute...