116140 matches found
Astra Linux – Vulnerability in Golang-1.19
The command go env command is documented as outputting a shell script containing the Go environment. However, go env does not sanitize the values it outputs. Therefore, executing its output as a shell script can lead to various malicious behaviors, including executing arbitrary commands or...
Astra Linux – Vulnerability in ModSecurity-Apache
ModSecurity is an open-source, cross-platform web application firewall WAF engine for Apache, IIS, and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which can lead to various issues depending on the HTTP scenario. For example, we have demonstrated...
Astra Linux – Vulnerability in Firefox
An attacker with temporary script access to a website could have set a cookie containing invalid characters using document.cookie, which could lead to unknown errors. This vulnerability affects Firefox versions earlier than 119...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. Chromium security severity: Medium...
Astra Linux – Vulnerability in dovecot
The attacker can upload a malicious Sieve script through the ManageSieve service or locally to bypass the configured CPU time limits for Sieve up to 130 times the configured limit. This allows the attacker to degrade server performance and bypass the configured CPU time limits for Sieve scripts. ...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...
Astra Linux – Vulnerability in Chromium
Insufficient validation of untrusted input in the Omnibox component of Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML through malicious network traffic. Chromium security severity: Medium...
Astra Linux – Vulnerability in LibreOffice
LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint servers. An additional scheme ‘vnd.libreoffice.command’ specific to LibreOffice was added. In the affected versions of LibreOffice, links using this scheme could be used to invoke internal macr...
Astra Linux – Vulnerability in Chromium
In DevTools in Google Chrome before version 126.0.6478.182, it was possible for an attacker to convince a user to install a malicious extension, allowing them to inject scripts or HTML into a privileged page through a crafted Chrome Extension. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
The inappropriate implementation of SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in the New Tab Page of Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts or HTML into a new browser tab through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts into the WebUI through a crafted HTML page...
Astra Linux – Vulnerability in Redis
Redis is an open-source, in-memory database that persists data on disk. A authenticated user may use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution. This issue has been fixed in versions 7.4.2, 7.2.7, and 6.2.17. An additional...
Astra Linux – Vulnerability in dovecot
Dovecot has provided a script that can be used for attaching files during text conversion. However, this script handles zip-style attachments in a way that is unsafe. An attacker could use specially crafted OOXML documents to cause unintended files on the system to be indexed, thereby ending up i...
CVE-2024-23176
A flaw was found in the MassMessage extension of MediaWiki. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into web pages viewed by other users. The flaw occurs when a specially crafted URL, specifically Special:MassMessage?uselang=x-xs...
CVE-2026-82790
Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-82792
Cross-site scripting vulnerability exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-82788
Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...