Most recent entries from all

bdu:2021-02617

certfr-2020-avi-216 — De multiples vulnérabilités ont été découvertes dans Oracle Database Server. Certaines d'entre elles permettent à un at…

certfr-2020-avi-216

CLEANSTART-2024-EC59064 — Cross-site scripting (XSS) vulnerability in jQuery UI before 1

Affected: CleanStart: drupal7

Security vulnerability affects the drupal7 package. Cross-site scripting (XSS) vulnerability in jQuery UI before 1.

cnvd-2017-04107

EUVD-2026-86427

fkie_cve-2016-7103

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

GHSA-hpcf-8vf9-q4gj — jQuery-UI vulnerable to Cross-site Scripting in dialog closeText

Affected: npm: jquery-ui, RubyGems: jquery-ui-rails, Maven: org.webjars.npm:jquery-ui, NuGet: jQuery.UI.Combined

Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function.

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog` function. If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.

## Recommendation

Upgrade to jQuery-UI 1.12.0 or later.

gsd-2016-7103

ICSA-19-155-01 — PHOENIX CONTACT PLCNext AXC F 2152

A remote attacker can exploit a server 's private key by sending carefully constructed UserIdentityTokens encrypted with the Basic128Rsa15 security policy. This could allow an attacker to decrypt passwords even if encrypted with another security policy such as Basic256Sha256. CVE-2018-7559 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L). An attacker with physical access to the device can manipulate SD card data, which could allow an attacker to bypass the authentication of the device. This device is designed for use in a protected industrial environment with restricted physical access.CVE-2019-10998 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker trying to connect to the device using a man-in-the-middle setup may crash the PLC service, resulting in a denial of service condition. The device must then be rebooted, or the PLC service must be restarted manually via Linux shell.CVE-2019-10997 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly ha…

openSUSE-SU-2024:11214-1 — python36-XStatic-jquery-ui-1.12.1.1-2.11 on GA media

python36-XStatic-jquery-ui-1.12.1.1-2.11 on GA media

RHSA-2016:2932 — Red Hat Security Advisory: python-XStatic-jquery-ui security update

jquery-ui: cross-site scripting in dialog closeText

SUSE-SU-2017:2351-1 — Security update for python-XStatic-jquery-ui

Security update for python-XStatic-jquery-ui

UBUNTU-CVE-2016-7103

Affected: Ubuntu:Pro:14.04:LTS: jqueryui, Ubuntu:Pro:16.04:LTS: jqueryui

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

VDE-2019-009 — PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 2152

Multiple vulnerabilities have been identified in PHOENIX CONTACT AXC F 2152 with firmware versions 1.x