GHSA-V7HC-87JC-QRRR eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations

Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...

eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations

Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...

CVE-2023-45966

The CVE-2023-45966 entry concerns umputun remark42 (versions 1.12.1 and earlier) with a Blind Server-Side Request Forgery (SSRF) vulnerability. Affected component: remark42; root cause is SSRF that is not fully exposed in the provided details. Impact per CVSS indicates high confidentiality impact...

Formwork Cross-site Scripting (XSS) from Page title field

Description A stored cross-site scripting XSS vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field. Only users with access to Administration Panel with page editing permission can inject raw HTML in th...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter...

CVE-2023-24230

Formwork v1.12.1 contains a stored XSS in the /formwork/panel/dashboard component, exploitable via the Page title field. Root cause is unsanitized input leading to script/HTML execution. CVSS 3.1 base score 4.8 (Medium) with PR:H, UI:R, scope Changed; impact on confidentiality/integrity is Low. A...