5233 matches found
Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function
Summary A stored Cross-site Scripting XSS vulnerability was identified in the Custom Rules function of the WebUI where attacker-controlled input is persisted by the backend and later rendered in the WebUI without proper output encoding. This allows arbitrary JavaScript execution in the context of...
CVE-2026-25136 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessa...
CVE-2026-25136 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessa...
CVE-2026-25136
CVE-2026-25136 - Rucio WebUI Reflected XSS : Affects Rucio WebUI, where the rendering of the ExceptionMessage in the 500 error could be exploited to steal login session tokens via a crafted URL. The issue is fixed in versions 35.8.3, 38.5.4, and 39.3.1. No exploitation details are provided in the...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure via the login process. An attacker can determine the existence of valid usernames by submitting login attempts and analyzing the differences in error messages returned by the system. Remediation Upgrade rucio-webui ...
EUVD-2026-8712
Rucio WebUI has Username Enumeration via Login Error Message...
Rucio WebUI has Username Enumeration via Login Error Message
Summary The WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. Details When submitting invalid credentials to /ui/login, the WebUI responds with different error messages based on th...
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability
Summary A reflected Cross-site Scripting vulnerability was located in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Details The WebUI error message renders ExceptionMessage...
EUVD-2026-8711
Rucio WebUI has a Reflected Cross-site Scripting Vulnerability...
PT-2026-22002
Name of the Vulnerable Software and Affected Versions Rucio versions prior to 35.8.3, 38.5.4, and 39.3.1 Description Rucio is a software framework used to organize, manage, and access large volumes of scientific data. A stored Cross-Site Scripting XSS issue exists in the Custom RSE Attribute of t...
CVE-2026-25735: Improper Neutralization of Input During Web Page Generation
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting XSS vulnerability in the Identity Name of the WebUI where...
CVE-2026-25734: Improper Neutralization of Input During Web Page Generation
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting XSS vulnerability in the RSE metadata of the WebUI where...
CVE-2026-25138: Observable Response Discrepancy
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Prior to versions 35.8.3, 38.5.4, and 39.3.1, the WebUI login endpoint returns distinct error messages depending on whether a supplied username...
CVE-2026-25733: Improper Neutralization of Input During Web Page Generation
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting XSS vulnerability in the Custom Rules function of the WebUI where...
CVE-2026-25736: Improper Neutralization of Input During Web Page Generation
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. Versions prior to 35.8.3, 38.5.4, and 39.3.1 have a stored Cross-Site Scripting XSS vulnerability in the Custom RSE Attribute of the WebUI where...
CVE-2026-25136: Improper Neutralization of Input During Web Page Generation
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. A reflected Cross-site Scripting vulnerability was located in versions prior to 35.8.3, 38.5.4, and 39.3.1 in the rendering of the ExceptionMessa...
Rucio 安全漏洞
Rucio is an open-source scientific data management tool developed by Rucio team. Versions of Rucio prior to 35.8.3, 38.5.4, and 39.3.1 contained security vulnerabilities. These vulnerabilities stemmed from uncontrolled input in the Identity Name field of the WebUI, which allowed attackers to...
CVE-2026-27025 vulnerabilities
Vulnerabilities for packages: open-webui...