| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| Use-after-free in the Crash Reporting component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. |
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. |
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. |
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. |
| Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and 1.61.4, native queries and actions against an H2 data source are passed through without restricting host-facing built-in functions. A user authorized to run native queries or actions can invoke FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases. The default sample database uses H2, so the vulnerable surface is exposed by default. This issue is fixed in versions 1.58.16, 1.59.13, 1.60.9, and 1.61.4. |
| Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
| Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. |
| An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information. |
| Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119. |
| The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions. |
| A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.6, FortiManager Cloud 7.6.2 through 7.6.6 may allow attacker to escalation of privilege via specially crafted packets |
| Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device. |
| Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the resulting error message is displayed. |
| Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page.
This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization. |
