6894 matches found
DRUPAL-CONTRIB-2024-039
This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers. The module doesn't sufficiently validate input in Content Security Policy CSP violation reports. This can cause errors when a logging module e.g. dblog or syslo...
CVE-2024-1656
Affected versions of Octopus Server had a weak content security policy...
CVE-2024-1656
Affected versions of Octopus Server had a weak content security policy...
CVE-2024-1656
Affected versions of Octopus Server had a weak content security policy...
CVE-2024-1656
CVE-2024-1656 affects Octopus Server; vulnerable component is the web content security policy implementation, described as a weak CSP. CVSSv3.1 base score 2.6 (Low) with Network attack vector, High attack complexity, Privileges required Low, User interaction Required. The exploitation status is n...
Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039
This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers. The module doesn't sufficiently validate input in Content Security Policy CSP violation reports. This can cause errors when a logging module e.g. dblog or syslo...
Octopus Server 安全漏洞
Octopus Server is a deployment automation and release management tool for continuous delivery from Octopus Australia. Octopus Server has a security vulnerability that stems from a weak content security policy...
CVE-2024-36511
FortiADC Web Application Firewall (WAF) is affected by CVE-2024-36511. The issue stems from an improperly implemented security check (CWE-358) in FortiADC WAF versions 6.0–7.4.4 when the cookie security policy is enabled, potentially allowing an attacker to retrieve the initial encrypted and sign...
CVE-2024-45299
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...
CVE-2024-45299 alf.io's preloaded data as json is not escaped correctly
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...
CVE-2024-45299
alf.io prior to version 2.0-M5 has an input escaping flaw in preloaded JSON data that can cause installation instability when administrators insert non-escaped text. The issue is mitigated by upgrading to version 2.0-M5, which fixes the escaping problem. The CSP blocks script execution; no exploi...
OESA-2024-2120 mozjs78 security update
SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security...
OESA-2024-2099 firefox security update
Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection. On a site...
PT-2024-31552 · Alf.Io · Alf.Io
Name of the Vulnerable Software and Affected Versions: alf.io versions prior to 2.0-M5 Description: The issue concerns an open source ticket reservation system for events. Prior to version 2.0-M5, the preloaded data as JSON is not escaped correctly. This allows an administrator or event admin to...
AZL-48581 CVE-2024-45310 affecting package kubernetes 1.28.4-25
runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers an...
CVE-2024-45310
runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers an...
[SECURITY] [DLA 3863-1] nbconvert security update
Debian LTS Advisory DLA-3863-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin September 02, 2024 https://wiki.debian.org/LTS Package : nbconvert Version : 5.6.1-3+deb11u1 CVE ID : CVE-2021-32862 Alvaro Muñoz from the GitHub Security Lab discovered sixteen ways to...
CVE-2024-8370 Grocy SVG File Upload recipepictures cross site scripting
A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument forceserveas with the input picture' leads to cross site scripting. T...
The vulnerability of the Content Security Policy component in Firefox browsers, including Firefox ESR, allows attackers to perform cross-site scripting attacks.
The vulnerability of the Content Security Policy component in Firefox browsers and Firefox ESR browsers is related to the failure to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to perform cross-site scripting attacks remotely...
Low: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.2 bug fixes and container updates
Red Hat Advanced Cluster Management for Kubernetes 2.11.2 General Availability release images, which fix bugs and update container images. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detail...