131 matches found
GHSA-WVPQ-H33F-8RP6 October CMS Vulnerable to Stored XSS via Branding Styles
A cross-site scripting XSS vulnerabilities was identified in October CMS backend configuration forms: - Branding and Appearances Styles A user with the Customize Backend Styles permission could inject malicious HTML/JS into the stylesheet input at Settings → Branding & Appearance → Styles. A...
[SECURITY] Fedora 42 Update: nginx-mod-fancyindex-0.5.2-13.fc42
The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: Custom headers. Either local or stored remotely. Cust...
[SECURITY] Fedora 43 Update: nginx-mod-fancyindex-0.5.2-13.fc43
The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: Custom headers. Either local or stored remotely. Cust...
ROS-20251020-08
A vulnerability in the JavaScript JSS web application styling tool is related to a memory leak in a non-standard configuration. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...
EUVD-2018-17875
Malware in sbrugna...
EUVD-2023-31369
Malicious code in bioql PyPI...
EUVD-2022-6446
Malicious code in bioql PyPI...
EUVD-2023-2717
Malicious code in bioql PyPI...
GitHub's Copilot Code Review: Can AI Spot Security Flaws Before You Commit?
As software development practices increasingly adopt AI-powered tools, ensuring that such tools can support secure coding has become critical. This study evaluates the effectiveness of GitHub Copilot's recently introduced code review feature in detecting security vulnerabilities. Using a curated...
MAL-2025-33064 Malicious code in shared-styling (npm)
The package shared-styling was found to contain malicious code...
Malicious code in shared-styling (npm)
The package shared-styling was found to contain malicious code...
MAL-2025-13788 Malicious code in @zalastax/nolb-react-sty (npm)
The package @zalastax/nolb-react-sty was found to contain malicious code...
CVE-2025-30145
GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This...
CVE-2025-30145
GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This...
CVE-2025-30145 GeoServer has an Infinite Loop Vulnerability in Jiffle process
GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This...
CVE-2025-30145
CVE-2025-30145 affects GeoServer; malicious Jiffle scripts can enter an infinite loop when used in WMS dynamic styling or a WPS process, enabling denial of service. Affected behavior is described as rendering transformations or WPS processes that may loop indefinitely. The issue is fixed in GeoSe...
PT-2025-24672 · Geoserver · Geoserver
Name of the Vulnerable Software and Affected Versions: GeoServer versions prior to 2.25.7 GeoServer versions prior to 2.26.3 GeoServer versions prior to 2.27.0 Description: The issue allows malicious Jiffle scripts to be executed, potentially triggering a denial of service through an infinite loo...
CVE-2023-41339
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an sld= parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles,...
CVE-2022-1416
Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling...