SUSE-SU-2025:21170-1 Security update for mozjs128

This update for mozjs128 fixes the following issues: - Update to version 128.14.0 bsc1248162: + CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP component + CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component + CVE-2025-9181: Uninitialized memo...

GHSA-424M-FJ2Q-G7VG Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

Impact Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. Workaround If the standard CSP rules are active default in production mode, an exploit isn't possible. Credits Lwin Min Oo...

EUVD-2025-200307

Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors...

Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

Impact Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled. Workaround If the standard CSP rules are active default in production mode, an exploit isn't possible. Credits Lwin Min Oo...

Google Go 安全漏洞

Google Go is a static strongly typed, compiled, concatenated, and garbage-collected programming language from Google USA. A security vulnerability exists in Google Go that stems from a subdomain constraint excluded from the crypto/x509 certificate chain that does not restrict the use of the...

Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors

Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Policy is disabled...

Cross-site Scripting (XSS)

Overview aimeos/ai-cms-grapesjs is an Aimeos GrapesJS CMS extension Affected versions of this package are vulnerable to Cross-site Scripting XSS via the authenticated editors. An attacker can execute arbitrary JavaScript code in the context of other users by injecting malicious scripts when the...

CVE-2025-66468

The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Polic...

CVE-2025-66468 Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors

The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Polic...

CVE-2025-66468 Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors

The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8, Javascript code can be injected by malicious editors for a stored XSS attack if the standard Content Security Polic...

CVE-2025-66468

The CVE-2025-66468 issue concerns the Aimeos GrapesJS CMS extension. Affected versions prior to 2021.10.8, 2022.10.8, 2023.10.8, 2024.10.8, and 2025.10.8 allow Javascript injection by authenticated editors resulting in a stored XSS when the standard CSP is disabled. The vulnerability is fixed in ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via incomplete sanitization of certain SVG and MathML attributes, including xlink:href, math|href, as well as the attributeName attribute of SVG animation elements when it is bound to href or xlink:href. An...

Aimeos GrapesJS CMS 跨站脚本漏洞

Aimeos GrapesJS CMS is a content management system for Aimeos Individual Developers. A cross-site scripting vulnerability exists in Aimeos GrapesJS CMS, which stems from the potential injection of JavaScript code when CSP is disabled, potentially leading to a stored cross-site scripting attack. T...

PT-2025-48754

Name of the Vulnerable Software and Affected Versions Aimeos GrapesJS CMS extension versions prior to 2021.10.8 Aimeos GrapesJS CMS extension versions prior to 2022.10.8 Aimeos GrapesJS CMS extension versions prior to 2023.10.8 Aimeos GrapesJS CMS extension versions prior to 2024.10.8 Aimeos...

Microsoft to Block Unauthorized Scripts in Entra ID Logins with 2026 CSP Update

Microsoft has announced plans to improve the security of Entra ID authentication by blocking unauthorized script injection attacks starting a year from now. The update to its Content Security Policy CSP aims to enhance the Entra ID sign-in experience at "login.microsoftonline.com" by only letting...

Exploring the SECURITY.Md in the Dependency Chain: Preliminary Analysis of the PyPI Ecosystem

Security policies, such as SECURITY.md files, are now common in open-source projects. They help guide responsible vulnerability reporting and build trust among users and contributors. Despite their growing use, it is still unclear how these policies influence the structure and evolution of softwa...

CRLF-Base64-Injection

🔥 CRLF + Base64 Injection Proof of Concept Author: Subir...

Google Chrome < 67.0.3396.79 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 67.0.3396.79. It is, therefore, affected by a vulnerability as referenced in the 201806stable-channel-update-for-desktop advisory. - Incorrect implementation in Content Security Policy in Google Chrome prior to...

Google Chrome < 67.0.3396.79 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 67.0.3396.79. It is, therefore, affected by a vulnerability as referenced in the 201806stable-channel-update-for-desktop advisory. - Incorrect implementation in Content Security Policy in Google Chrome prior to 67.0.3396....

Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint

Summary A Cross-Site Scripting XSS vulnerability exists in Astro when using the @astrojs/cloudflare adapter with output: 'server'. The built-in image optimization endpoint /image uses isRemoteAllowed from Astro’s internal helpers, which unconditionally allows data: URLs. When the endpoint receive...