CVE-2024-29877 Cross-Site Scripting (XSS) vulnerability in Sentrifugo

Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/expenses/expensecategories/edit, 'expensecategoryname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

CVE-2024-29877

Sentrifugo 3.2 is affected by a Cross-Site Scripting (XSS) vulnerability in the endpoint /sentrifugo/index.php/expenses/expensecategories/edit, via the expense_category_name parameter. The issue arises from insufficient input filtering/escaping, enabling a remote attacker to craft a URL that coul...

Deno security vulnerabilities

Deno is open source a simple , modern and secure JavaScript and TypeScript runtime environment . It uses V8 and is built with Rust. A security vulnerability exists in Deno versions 1.35.1 through 1.36.3, which stems from a Node.js compatibility issue that reuses the global buffer in streamwrap.ts...

PT-2024-23101 · Unknown · Sentrifugo

Name of the Vulnerable Software and Affected Versions: Sentrifugo version 3.2 Description: A Cross-Site Scripting XSS issue exists, allowing a remote user to send a specially crafted URL to the victim and steal their session data. This is achieved through the...

PT-2024-23103

Name of the Vulnerable Software and Affected Versions Sentrifugo version 3.2 Description The issue is a Cross-Site Scripting XSS vulnerability that could allow a remote user to send a specially crafted URL to the victim and steal their session data. This is achieved through the...

CVE-2024-29878: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

CVE-2024-29877: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/expenses/expensecategories/edit, 'expensecategoryname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

CVE-2022-46070

creationtimestamp| type| source ---|---|--- 2024-03-11 23:26:59+00:00| seen| https://t.me/ctinow/205130 2024-03-11 23:27:10+00:00| seen| https://t.me/ctinow/205138 2025-04-16 15:56:10+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12082...

CVE-2024-27935

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets o...

CVE-2024-27935 Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets o...

CVE-2024-27935: Exposure of Data Element to Wrong Session

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets o...

Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

Summary A vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer BUF in streamwrap.ts used as a performance...

GHSA-WRQV-PF6J-MQJP Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination

Summary A vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. The issue arises from the re-use of a global buffer BUF in streamwrap.ts used as a performance...

PT-2024-22149 · Deno · Deno

Name of the Vulnerable Software and Affected Versions: Deno versions 1.35.1 through 1.36.2 Description: A vulnerability in Deno's Node.js compatibility runtime allows for cross-session data contamination during simultaneous asynchronous reads from Node.js streams sourced from sockets or files. Th...

SUSE CVE-2024-26144

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain...

DEBIAN-CVE-2024-26144

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain...

Exposure of Data Element to Wrong Session

Overview Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the default behavior of sending a Set-Cookie header along with the user's session cookie when serving blobs and setting Cache-Control to public. Certain proxies may cache the Set-Cookie,...

CVE-2024-25122 Cross-site Scripting sidekiq-unique-jobs UI server vulnerability

sidekiq-unique-jobs is an open source project which prevents simultaneous Sidekiq jobs with the same unique arguments to run. Specially crafted GET request parameters handled by any of the following endpoints of sidekiq-unique-jobs' "admin" web UI, allow a super-user attacker, or an unwitting, bu...

OESA-2023-1922 python-flask security update

Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks...

com.jfinal:jfinal-undertow (3.0), com.lastb7:jfinal-swagger-knife4j (>=2.10.1, <=3.0.0) +2 more potentially affected by CVE-2023-50449 via com.jfinal:jfinal (5.0.0)

com.jfinal:jfinal MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - com.jfinal:jfinal-undertow 3.0 - com.lastb7:jfinal-swagger-knife4j =2.10.1, =1.0.4, =3.15.1, =3.15.5 Source cves:...