Design/Logic Flaw

An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri function...

Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

Impact We found a possible XSS vector in the Filter.FilterStreamDescriptorForm wiki page related to pretty much all the form fields printed in the home page of the application. Patches The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. Workarounds The easiest workaround is to...

GHSA-XJFW-5VV5-VJQ2 Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

Impact We found a possible XSS vector in the Filter.FilterStreamDescriptorForm wiki page related to pretty much all the form fields printed in the home page of the application. Patches The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. Workarounds The easiest workaround is to...

CVE-2021-33254

An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri function...

Security Bulletin: Vulnerability in RC4 stream cipher affects IMS™ Enterprise Suite: Connect API for Java, SOAP Gateway, and Explorer for Development (CVE-2015-2808)

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, IBM SDK, Java Technology Edition, Version 7 Service Refresh 8 that is used the following IMS™ Enterprise Suite components: Connect API for Java, SOAP Gateway, and Explorer for Development. This bulletin also addresse...

CVE-2021-33254: NULL Pointer Dereference

An issue was discovered in src/http/httpLib.c in EmbedThis Appweb Community Edition 8.2.1, allows attackers to cause a denial of service via the stream paramter to the parseUri function...

PT-2022-10223

Name of the Vulnerable Software and Affected Versions Appweb Community Edition version 8.2.1 Description An issue was discovered in the src/http/httpLib.c file, allowing attackers to cause a denial of service via the stream parameter to the parseUri function. Recommendations For Appweb Community...

CVE-2022-29258 Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI...

CVE-2022-29258 Cross-site Scripting in Filter Stream Converter Application in XWiki Platform

XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Starting with versions 6.0-milestone-2 and 5.4.4 and prior to versions 12.10.11, 14.0-rc-1, 13.4.7, and 13.10.3, XWiki Platform Filter UI...

PT-2022-37746

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47560 Crash type: Stack-use-after-scope READ Crash state: RefCopyBytes DoCopyBytes dng stream::Put...

Cross-Site Scripting (XSS)

octoprint is vulnerable to cross-site scripting. The vulnerability exists in webcam stream test due to lack of sanitization which allows a malicious attacker to inject and execute arbitrary javascript...

Cross-site Scripting in OctoPrint

Cross-site Scripting XSS - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. The Stream URL of octoprint application allowing a xss payload to execute...

GHSA-H8PC-J334-JJHM Cross-site Scripting in OctoPrint

Cross-site Scripting XSS - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. The Stream URL of octoprint application allowing a xss payload to execute...

PT-2022-36994

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read error. Technical details include a crash type of Heap-buffer-overflow READ 8, with a crash state...

[SECURITY] Fedora 34 Update: libxml2-2.9.14-1.fc34

This library allows to manipulate XML files. It includes support to read, modify and write XML and HTML files. There is DTDs support this includes parsing and validation even with complex DtDs, either at parse time or later once the document has been modified. The output can be a simple SAX strea...

PT-2022-13885

Name of the Vulnerable Software and Affected Versions octoprint versions prior to 1.8.0 Description The issue is related to Cross-site Scripting XSS - Generic in the octoprint application. Specifically, the Stream URL allows a XSS payload to execute. Recommendations For versions prior to 1.8.0,...

OctoPrint cross-site scripting vulnerabilities

OctoPrint is an application that provides a fast web interface for controlling consumer 3D printers. A cross-site scripting vulnerability exists in versions prior to OctoPrint 1.8.0, which stems from a lack of filtering and escaping of data in the software webcam stream test. An attacker could us...

GHSA-5V5W-44W6-Q5HV Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream

Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...

Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream

Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service resource consumption via a crafted XMPP stream, aka an "xmppbomb" attack...

com.github.widebase:widebase-stream-handler-cq_2.9.1 (>=0.1.0, <=0.2.2), com.github.widebase:widebase-stream-handler-cq_2.9.2 (>=0.2.3, <=0.3.3) +180 more potentially affected by CVE-2015-6524 via org.apache.activemq:activemq-jaas (>=5.0.0, <=5.10.1)

org.apache.activemq:activemq-jaas MAVEN version =5.0.0, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =0.1.0, =0.2.3, =2.0.0, =2.3.3, =2.5.1 and more Source cves: CVE-2015-6524 Source advisory: OSV:GHSA-23CR-5HR4-RGWV...