Security update for kubernetes1.27

This update for kubernetes1.27 fixes the following issues: CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2025:02336-1 Security update for kubernetes1.27

This update for kubernetes1.27 fixes the following issues: - CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865...

Security update for kubernetes1.24

This update for kubernetes1.24 fixes the following issues: CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: CVE-2025-22872: Properly handle trailing solidus in unquoted attribute value in foreign content bsc1241865. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2021-43805

Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential...

CVE-2021-41274

solidusauthdevise provides authentication services for the Solidus webstore framework, using the Devise gem. In affected versions solidusauthdevise is subject to a CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevi...

CVE-2025-22872 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

CVE-2024-4859

Solidus vulnerability CVE-2024-4859 affects Solidus

CVE-2024-4859

Solidus = 4.3.4 is affected by a Stored Cross-Site Scripting vulnerability in the order tracking URL...

PT-2024-33157 · Solidus · Solidus

Name of the Vulnerable Software and Affected Versions: Solidus versions prior to 4.3.5 Description: The issue is related to a Stored Cross-Site Scripting vulnerability in the order tracking URL. Recommendations: For versions prior to 4.3.5, update to version 4.3.5 or later to resolve the issue...

Solidus 跨站脚本漏洞

Solidus is an open source e-commerce system. A cross-site scripting vulnerability exists in Solidus. An attacker could exploit this vulnerability to perform a cross-site scripting attack...

Cross Site Request Forgery (CSRF)

solidus is vulnerable to cross-site request forgery. The vulnerability exists in routes.rb due to a lack of input validation, allowing an attacker to inject and execute arbitrary javascript to make changes to the system...

solidus_backend cross-site request forgery vulnerability

Solidus is an open source e-commerce system. solidusbackend is the administrative interface of the Solidus e-commerce framework. solidusbackend is vulnerable to cross-site request forgery, which can be exploited by attackers to change the status of order adjustments while holding an order number,...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF by allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Remediation Upgrade solidusbackend to version...

CVE-2022-31000

solidusbackend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery CSRF vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the...

CVE-2022-31000 CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

solidusbackend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery CSRF vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the...