Tucows (VDP): Stored XSS in nameserver field on account settings page

A stored XSS vulnerability was discovered in the nameserver field on the account settings page. The lack of input validation and weak CSP configuration allowed the injection of malicious JavaScript code that executed when the settings page was reloaded. The vulnerability was limited to a self-XSS...

CVE-2024-1656

Affected versions of Octopus Server had a weak content security policy...