Most recent entries from all

ALSA-2020:4670 — Moderate: idm:DL1 and idm:client security, bug fix, and enhancement update

2026-10-03T01:35:04.089274+00:00

Affected: AlmaLinux:8: custodia, AlmaLinux:8: python3-custodia, AlmaLinux:8: python3-jwcrypto, AlmaLinux:8: python3-kdcproxy, AlmaLinux:8: python3-pyusb, AlmaLinux:8: python3-qrcode, AlmaLinux:8: python3-qrcode-core, AlmaLinux:8: python3-yubico

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

The following packages have been upgraded to a later upstream version: ipa (4.8.7), softhsm (2.6.0), opendnssec (2.1.6). (BZ#1759888, BZ#1818765, BZ#1818877)

Security Fix(es):

* js-jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

* bootstrap: XSS in the data-target attribute (CVE-2016-10735)

* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

* bootstrap: XSS in the tooltip data-viewport attribute (CVE-2018-20676)

* bootstrap: XSS in the affix configuration target property (CVE-2018-20677)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* js-jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)

* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

* ipa: No password length restriction leads to denial of service (CVE-2020-1722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information o…

certfr-2021-avi-571 — De multiples vulnérabilités ont été découvertes dans Tenable. Elles permettent à un attaquant de provoquer une exécutio…

2026-10-03T01:35:04.089385+00:00

certfr-2021-avi-571

cnvd-2018-13372

2026-10-03T01:35:04.089407+00:00

cnvd-2018-13372

EUVD-2026-66872

2026-10-03T01:35:04.089420+00:00

EUVD-2026-66872

fkie_cve-2018-14040

2026-10-03T01:35:04.089431+00:00

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

GHSA-3wqf-4x89-9g79 — Bootstrap vulnerable to Cross-Site Scripting (XSS)

2026-10-03T01:35:04.089452+00:00

Affected: npm: bootstrap, RubyGems: bootstrap, Maven: org.webjars:bootstrap, NuGet: bootstrap, NuGet: bootstrap.sass, RubyGems: bootstrap-sass, Packagist: twbs/bootstrap

In Bootstrap starting in version 2.3.0 and prior to 3.4.0, as well as 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.

gsd-2018-14040

2026-10-03T01:35:04.089485+00:00

gsd-2018-14040

ICSA-22-055-02 — Mitsubishi Electric EcoWebServerIII

2026-10-03T01:35:04.089498+00:00

Multiple vulnerabilities due to cross-site scripting exist in Energy Saving Data Collecting Server (EcoWebServerIII), which may result in information disclosure or information tampering of the product.CVE-2016-10735, CVE-2018-14040, CVE-2018-14042, CVE-2018-20676, CVE-2019-8331, CVE-2020-11022, and CVE-2020-11023 have been assigned to these vulnerabilities. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ). A vulnerability due to uncontrolled resource consumption exists in Energy Saving Data Collecting Server (EcoWebServerIII), which may result in a denial-of-service condition.CVE-2017-18214 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated for; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A vulnerability due to improperly controlled modification of dynamically determined object attributes exists in Energy Saving Data Collecting Server (EcoWebServerIII), which may result in a denial-of-service condition.CVE-2020-7746 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated for; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

msrc_CVE-2018-14040 — In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attributeIn Bootstrap before 4.1.2, XSS is possi…

2026-10-03T01:35:04.089525+00:00

msrc_CVE-2018-14040

RHSA-2020:3936 — Red Hat Security Advisory: ipa security, bug fix, and enhancement update

2026-10-03T01:35:04.089542+00:00

jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property bootstrap: XSS in the tooltip or popover data-template attribute jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection ipa: No password length restriction leads to denial of service jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

RHSA-2020:4670 — Red Hat Security Advisory: idm:DL1 and idm:client security, bug fix, and enhancement update

2026-10-03T01:35:04.089579+00:00

UBUNTU-CVE-2018-14040

2026-10-03T01:35:04.089608+00:00

Affected: Ubuntu:16.04:LTS: twitter-bootstrap, Ubuntu:Pro:16.04:LTS: twitter-bootstrap3, Ubuntu:18.04:LTS: twitter-bootstrap, Ubuntu:Pro:18.04:LTS: twitter-bootstrap3

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

WID-SEC-W-2023-0239 — Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen

2026-10-03T01:35:04.089631+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, ein Cross-Site-Scritping-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.