3524 matches found
docbook-style-xsl bug fix and enhancement update
An update is available for docbook-style-xsl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...
cookie tossing attack
Overview Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. Recommendation Upgrade to version 3.1.0 or later References - CVE - GitHub Advisory...
JavaScript Fraud: More Than Just Magecart and Skimming
The global pandemic has driven a sharp rise in online traffic that provides fertile ground for attackers to execute a growing number of more sophisticated client-side attacks. For example, Magecart-style attacks are used to steal sensitive information by skimming data either through a first-party...
Arbitrary JavaScript Execution
Overview There is a security vulnerability in json-ptr versions prior to v2.1.0 in which an unscrupulous actor may execute arbitrary code. If your code sends un-sanitized user input to json-ptr's .get method, your project is vulnerable to this injection-style vulnerability. Recommendation Upgrade...
GHSA-QM28-7HQV-WG5J OS Command Injection in ng-packagr
The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option...
CVE-2021-24159
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clickin...
Cross site request forgery (csrf)
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into...
CVE-2021-24159
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clickin...
CVE-2021-24159 Contact Form 7 Style <= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clickin...
[SECURITY] Fedora 34 Update: gnote-40~rc-1.fc34
Gnote is a desktop note-taking application which is simple and easy to use. It lets you organize your notes intelligently by allowing you to easily link ideas together with Wiki style interconnects. It is a port of Tomboy to C++ and consumes fewer resources...
[SECURITY] Fedora 34 Update: plasma-oxygen-5.21.3-1.fc34
Plasma and Qt widget style and window decorations for Plasma 5 and KDE 4...
[SECURITY] Fedora 34 Update: plasma-breeze-5.21.3-1.fc34
Artwork, styles and assets for the Breeze visual style for the Plasma Deskt op...
Fedora: Security Advisory for qqc2-breeze-style (FEDORA-2021-85c9774673)
The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Prototype Pollution
style-dictionary is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
@fluentui/token-pipeline (>=0.3.3, <=0.22.0), @inmotionnow/momentum-components (>=8.2.2-next.2, <=102.37.5) +7 more potentially affected by unknown CVE via style-dictionary (>=2.5.0, <=2.10.2)
style-dictionary NPM version =2.5.0, =0.3.3, =8.2.2-next.2, =1.0.2, =0.1.0, =0.0.2, =1.0.0, =8.1.3, =6.0.0, =8.2.2-next.2 Source cves: unknown CVE Source advisory: SNYK:JS-STYLEDICTIONARY-1080632...
Prototype Pollution
Overview style-dictionary is a Style once, use everywhere. A build system for creating cross-platform styles. Affected versions of this package are vulnerable to Prototype Pollution. PoC const StyleDictionary = require'style-dictionary'; const obj = ; let opts =...
WordPress Style Kits plugin <= 1.8.0 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by NintechNet in WordPress Style Kits plugin versions = 1.8.0. Solution Update the WordPress Style Kits plugin to the latest available version at least 1.8.1...
Virginia Data Privacy Law
Virginia is about to get a data privacy law, modeled on Californias law...
Fedora 32 : roundcubemail (2021-aef54ec149)
The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-aef54ec149 advisory. - Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets CSS token sequences during HTML email rendering. CVE-2021-26925 Note that...