34 matches found
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
Summary Any authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. When that happens the renderer falls back to inserting the original math source into the page as HTML rather than as text, so script in the message runs in the...
Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in react-pdf-5.0.0.tgz
Summary Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in react-pdf-5.0.0.tgz Vulnerability Details CVEID:CVE-2024-34342 DESCRIPTION: react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with...
EUVD-2018-16943
Malware in sbrugna...
EUVD-2017-6046
Malware in sbrugna...
EUVD-2017-6075
Malware in sbrugna...
EUVD-2017-5802
Malware in sbrugna...
EUVD-2019-7135
Malware in sbrugna...
EUVD-2017-5797
Malware in sbrugna...
EUVD-2017-6187
Malware in sbrugna...
EUVD-2017-6189
Malware in sbrugna...
EUVD-2022-5005
Malicious code in bioql PyPI...
EUVD-2024-22906
Malicious code in bioql PyPI...
EUVD-2025-5603
Malicious code in bioql PyPI...
CVE-2024-48463
Bruno before 1.29.1 uses Electron shell.openExternal without validation of http or https for opening windows within the Markdown docs viewer...
CVE-2019-13244
FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x0000000000002d7d...
PT-2025-17066 · Bernd Altmeier · Bernd Altmeier Google Maps Gpx Viewer
Name of the Vulnerable Software and Affected Versions: Bernd Altmeier Google Maps GPX Viewer versions n/a through 3.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an...
CVE-2024-52298
macro-pdfviewer is a PDF Viewer Macro for XWiki using Mozilla pdf.js. The PDF Viewer macro allows an attacker to view any attachment using the "Delegate my view right" feature as long as the attacker can view a page whose last author has access to the attachment. For this, the attacker only needs...
IrfanView out-of-bounds write vulnerability (CNVD-2024-47203)
IrfanView is an image viewer by the individual developer Irfan Skiljan. It supports image browsing, image editing, image format conversion and more. IrfanView suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to execute code in the context of the current proce...
[SECURITY] [DLA 3924-1] php-horde-mime-viewer security update
Debian LTS Advisory DLA-3924-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost October 19, 2024 https://wiki.debian.org/LTS Package : php-horde-mime-viewer Version : 2.2.4+debian0-2deb11u1 CVE ID : CVE-2022-26874 Debian Bug : It was discovered that there was a...
