magento2-cosmic-sting-patch

Magento 2 Patch for CVE-2024-34102aka Cosmic Sting An alternative solutionas a Magento 2 extension to fix the XXE vulnerability CVE-2024-34102aka Cosmic Sting. If you cannot upgrade Magento or cannot apply the official patch, try this one. If you don't fix this vulnerability, the attacker can RCE...

GO-2026-5484 Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server

Mattermost doesn't escape some variables that could contain malicious content during error page composition in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...

EUVD-2026-30742

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to escape some variables that could contain malicious content during error page composition which allows an attacker with access to edit some site configuration to execute some malicious code via injecting some JS as part of those...

PT-2026-41641

Name of the Vulnerable Software and Affected Versions Mattermost versions 11.5.0 through 11.5.1 Mattermost versions 10.11.0 through 10.11.13 Description Failure to escape certain variables during the composition of error pages allows an attacker with permissions to edit site configurations to...

Apache HTTP Server: mod_ssl error log variable escaping

...

CVE-2020-1734

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by...

Stored XSS vulnerability in m2release

m2release did not properly escape variables in multiple views, resulting in a stored cross-site scripting vulnerability. Variables on affected views are now escaped...

Serendipity -- XSS Vulnerabilities

The Serendipity Team reports: Serendipity failed to correctly sanitize user input on the media manager administration page. The content of GET variables were written into JavaScript strings. By using standard string evasion techniques it was possible to execute arbitrary JavaScript. Additionally...