Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the contentsecuritypolicy helper. An attacker can inject new directives into the CSP and bypass its protection mechanisms by crafting inputs that exploit the dynamic setting of CSP headers from untrusted...

CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

DEBIAN-CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

UBUNTU-CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

CVE-2024-54133

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set...

GHSA-VFM5-RMRH-J26V Possible Content Security Policy bypass in Action Dispatch

There is a possible Cross Site Scripting XSS vulnerability in the contentsecuritypolicy helper in Action Pack. Impact ------ Applications which set Content-Security-Policy CSP headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new...

CVE-2024-10496

An out of bounds read due to improper input validation in BuildFontMap in fontmgr.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q...

Adobe InDesign 安全漏洞

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign suffers from a heap buffer overflow vulnerability that originates from a boundary error when the application processes untrusted input. An attacker could exploit the vulnerability to...

Adobe Substance 3D Sampler 安全漏洞

Adobe Substance 3D Sampler is a photogrammetry software from the American company Audobee Adobe. It is used to convert photo captures and scanned images into 3D textures and material assets. Adobe Substance 3D Sampler suffers from a heap buffer overflow vulnerability that originates from a bounda...

Siemens Teamcenter Visualization和Siemens Tecnomatix Plant Simulation 安全漏洞

Siemens Teamcenter Visualization is software that provides teamwork capabilities for designing 2D and 3D scenarios. The software simplifies the engineering and manufacturing process by creating virtual prototypes from a variety of mechanical computer-aided design MCAD formats.Siemens Tecnomatix...

Adobe Framemaker 安全漏洞

Adobe FrameMaker is Adobe's development of professional-grade technical document creation and layout software, mainly used to deal with complex long-form structured content such as technical manuals, aviation documents, etc., support for XML/DITA standards, multilingual publishing and cross-media...

Adobe After Effects 安全漏洞

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. Adobe After Effects suffers from a buffer overflow vulnerability that...

Rails Action Pack 跨站脚本漏洞

Rails Action Pack is a web framework from the US Rails team. It provides a mechanism for routing mapping request URLs to actions, defining controllers that implement actions, and generating responses by rendering views templates in various formats. A cross-site scripting vulnerability exists in...

CVE-2024-11501

CVE-2024-11501 concerns the WordPress Gallery plugin (versions

PT-2024-17035 · WordPress · Gallery

Name of the Vulnerable Software and Affected Versions: The Gallery plugin for WordPress versions up to, and including, 1.3 Description: The Gallery plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input from the wd gallery $id parameter. This makes it...

CVE-2024-53856 rPGP Panics on Malformed Untrusted Input

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1...

CVE-2024-10587

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted input. This makes it possible for authenticated attackers,...

CVE-2024-10587 Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection

The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.5.1 via deserialization of untrusted input. This makes it possible for authenticated attackers,...

DEBIAN-CVE-2024-52806

SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an untrusted XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18...

GHSA-WQ8X-CG39-8MRR org.keycloak:keycloak-services has Inefficient Regular Expression Complexity

A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service DoS scenario by exhausting system resources due to a Regex complexity...