CWE-86

Biblioteka `org.xwiki.commons:xwiki-commons-xml` używana przez platformę XWiki zawiera podatność XSS w sanitizerze HTML, który niepoprawnie waliduje atrybuty data. Pozwala to atakującemu na wstrzyknięcie dowolnego kodu HTML, co może prowadzić do przejęcia sesji użytkownika lub wykonania złośliwych skryptów w kontekście aplikacji.

Improper neutralization in some Intel(R) Arc(TM) & Iris(R) Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access.

Improper neutralization in some Intel(R) Ethernet Adapters and Intel(R) Ethernet Controller I225 Manageability firmware may allow a privileged user to potentially enable escalation of privilege via local access.

A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affects Firefox < 126.

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device. Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device. Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have at least a low-privileged account on an affected device. Cisco has not released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

Vim to edytor tekstu open source działający w linii poleceń. W wersjach przed 9.2.0073 istnieje luka command injection w standardowej wtyczce `netrw` dołączonej do Vima. Atakujący może wykonać dowolne polecenia shell z uprawnieniami procesu Vima, nakłaniając użytkownika do otwarcia spreparowanego URL-a (np. przy użyciu protokołu `scp://`). Wersja 9.2.0073 naprawia ten problem.

Nieprawidłowa neutralizacja w oprogramowaniu Intel(R) oneVPL GPU w wersjach poniżej 22.6.5 może pozwolić uwierzytelnionemu użytkownikowi na potencjalne uruchomienie ataku denial of service poprzez dostęp lokalny.

W produkcie FAST/TOOLS dostarczanym przez Yokogawa Electric Corporation odkryto lukę w zabezpieczeniach związaną z niewłaściwym kodowaniem adresów URL. Atakujący mógłby manipulować stronami internetowymi lub wykonywać złośliwe skrypty. Podatne są wersje FAST/TOOLS (pakiety: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) od R9.01 do R10.04.