SUSE-SU-2025:02423-1 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - CVE-2021-25743: Escape terminal special characters in kubectl output bsc1194400. - CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement bsc1212493. - CVE-2024-0793: Advance autoscaling v2 as the preferred API version...

Security update for kubernetes1.25

This update for kubernetes1.25 fixes the following issues: CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2025:02351-1 Security update for kubernetes1.25

This update for kubernetes1.25 fixes the following issues: - CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865...

Security update for kubernetes1.27

This update for kubernetes1.27 fixes the following issues: CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2025:02336-1 Security update for kubernetes1.27

This update for kubernetes1.27 fixes the following issues: - CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865...

Security update for kubernetes1.24

This update for kubernetes1.24 fixes the following issues: CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2021-43805

Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential...

CVE-2021-41274

solidusauthdevise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidusauthdevise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevi...

CVE-2025-22872 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2024-4859

Solidus vulnerability CVE-2024-4859 affects Solidus

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2024-4859: Improper Neutralization of Input During Web Page Generation

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

Solidus 跨站脚本漏洞

Solidus is an open source e-commerce system. A cross-site scripting vulnerability exists in Solidus. An attacker could exploit this vulnerability to perform a cross-site scripting attack...

PT-2024-33157 · Solidus · Solidus

Name of the Vulnerable Software and Affected Versions: Solidus versions prior to 4.3.5 Description: The issue is related to a Stored Cross-Site Scripting vulnerability in the order tracking URL. Recommendations: For versions prior to 4.3.5, update to version 4.3.5 or later to resolve the issue...

Cross Site Request Forgery (CSRF)

solidus is vulnerable to cross-site request forgery. The vulnerability exists in routes.rb due to a lack of input validation, allowing an attacker to inject and execute arbitrary javascript to make changes to the system...