Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities

Summary IBM QRadar SIEM includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. These have been addressed in the update. Vulnerability Details CVEID:CVE-2023-26049 DESCRIPTION: Eclipse Jetty could allow a remote authenticated attacker ...

Cross-site Scripting (XSS)

Dynamic Dashboard is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper validation of values passed to a paragraph widget, allowing malicious characters to trigger XSS attacks when a user opens a page where the widget is rendered...

Security Bulletin: A vulnerability in Go affects IBM Robotic Process Automation for Cloud Pak which could allow an attacker to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. (CVE-2015-5739)

Summary A vulnerability in Go affects IBM Robotic Process Automation for Cloud Pak which could allow an attacker to poison the web cache, bypass web application firewall protection, and conduct XSS attacks. IBM Robotic Process Automation for Cloud Pak uses Go as part of it's operator deployment...

WordPress LiteSpeed Cache Plugin Security Flaw Exposes Sites to XSS Attacks

A new high-severity security flaw has been disclosed in the LiteSpeed Cache plugin for WordPress that could enable malicious actors to execute arbitrary JavaScript code under certain conditions. The flaw, tracked as CVE-2024-47374 CVSS score: 7.2, has been described as a stored cross-site scripti...

DOM Clobbering

Rollup is vulnerable to a DOM Clobbering. The vulnerability is due to improper handling of import.meta properties in cjs/umd/iife formats, which allows an attacker to perform cross-site scripting XSS attacks through unsanitized HTML elements, like an img tag with an unsanitized name attribute...

Security Bulletin: Vulnerabilities in Netty affect IBM watsonx.data

Summary Netty is vulnerable to HTTP request smuggling and weaker than expected security. These can affect watsonx.data. Vulnerability Details CVEID:CVE-2019-20444 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw in the HttpObjectDecoder.java. By sending a...

Cross Site Scripting(XSS)

@rspack/core is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to a DOM Clobbering gadget in the AutoPublicPathRuntimeModule, which allows unsanitized attacker-controlled HTML elements to lead to XSS attacks...

CVE-2024-45812

A DOM clobbering vulnerability was found in ViteJS. This may lead to cross-site scripting XSS attacks on websites that include Vite-bundled files configured with an output format of cjs, iife, or umd, and allow users to inject certain scriptless HTML tags without properly sanitizing the name or i...

PT-2024-7486 · WordPress · Relevanssi

Name of the Vulnerable Software and Affected Versions: Relevanssi WordPress plugin versions prior to 4.23.1 Description: The issue allows for Stored XSS attacks by embedding malicious scripts, potentially leading to account takeover. This can be exploited by a remote attacker to perform cross-sit...

PT-2025-6048

Name of the Vulnerable Software and Affected Versions npm-serialize-javascript versions up to 6.0.1 Description The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to injec...

CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS

Discourse Calendar plugin adds the ability to create a dynamic calendar in the first post of a topic to Discourse. Rendering event names can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse’s default Content Security Policy. The issue ...

Security Bulletin: Vulnerability in Go affects watsonx.data

Summary Golang Go is vulnerable to HTTP request smuggling, caused by a flaw when using MaxBytesHandler. This could affect watsonx.data. Vulnerability Details CVEID:CVE-2022-41721 DESCRIPTION: Golang Go is vulnerable to HTTP request smuggling, caused by a flaw when using MaxBytesHandler. By sendin...

PT-2025-25439 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 15.10.16 XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.2 Description: The issue arises when a user without script rights creates a document containing an XWiki.Notifications.Code.NotificationDisplayerCla...

ROS-20240828-01

A vulnerability in the koji RPM-based build system is related to improper neutralization of input data during the during web page generation. Exploitation of the vulnerability could allow an attacker to conduct XSS attacks using a specially crafted web interface. using a specially crafted web...

CVE-2024-6710

The CVE-2024-6710 issue affects the Ditty WordPress plugin prior to version 3.1.45. It stems from inadequate sanitisation/escaping of certain parameters, enabling attackers with as little as Contributor-level access to perform Cross-Site Scripting (XSS) attacks. Red Hat’s advisory reiterates the ...

CVE-2024-6578 Stored XSS in aimhubio/aim

A stored cross-site scripting XSS vulnerability exists in aimhubio/aim version 3.19.3. The vulnerability arises from the improper neutralization of input during web page generation, specifically in the logs-tab for runs. The terminal output logs are displayed using the dangerouslySetInnerHTML...

ROS-20240729-03

A vulnerability in the GLPI reports plugin of the GLPI reports system is related to incorrect neutralization of input data during web page generation. neutralization of input data during web page generation. Exploitation of the vulnerability could allow a remote attacker to conduct XSS attacks...

PT-2024-28353

Name of the Vulnerable Software and Affected Versions janeczku Calibre-Web versions 0.6.0 through 0.6.21 Description The issue arises from improper sanitization performed by the clean string function, specifically in the way it handles HTML sanitization, making the edit book comments function...

CVE-2024-6742

CVE-2024-6742 affects AguardNet Technology’s Space Management System. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw caused by improper input filtering of user-supplied data, enabling remote attackers with regular privileges to inject JavaScript. The available sources describe t...

PT-2024-30114 · WordPress · Support Svg Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Support SVG WordPress plugin versions prior to 1.1.0 Description: The issue allows users with at least the author role to upload SVG files containing malicious JavaScript, leading to Stored XSS attacks. This is due to the lack of...