https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:35:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-196003 EUVD-2026-196003 https://cve.radiocsirt.org/vuln/euvd-2026-196003 https://cve.radiocsirt.org/vuln/fkie_cve-2023-32193 <p>A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman&#39;s public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.</p> <p>A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman&#39;s public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-32193 https://cve.radiocsirt.org/vuln/ghsa-r8f4-hv23-6qp6 <p><strong>Affected:</strong> Go: github.com/rancher/norman</p> <p>### Impact A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman&#39;s public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.</p> <p>The attack vector was identified as a Reflected XSS.</p> <p>Norman API propagates malicious payloads from user input to the UI, which renders the output. For example, a malicious URL gets rendered into a script that is executed on a page.</p> <p>The changes addressed by this fix are: - Encode input that comes from the request URL before adding it to the response. - The request input is escaped by changing the URL construction that is used for links to use `url.URL`. - The request input is escaped by escaping the JavaScript and CSS variables with attribute encoding as defined by [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-rules-summary).</p> <p>### Patches Patched versions include the following commits:</p> <p>| Branch | Commit | | -------- | ------- | | master | 3bb70b7 | | release/v2.8 | a6a6cf5 | | release/v2.7 | cb54924 | | release/v2.7.s3 | 7b2b467 | | release/v2.6 | bd13c65 |</p> <p>### Workarounds There is no direct mitigation besides updating Norman API to a patched version.</p> <p>### References If you have any questions or comments about this advisory:</p> <p>- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for secur…</p> <p><strong>Affected:</strong> Go: github.com/rancher/norman</p> <p>### Impact A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman&#39;s public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.</p> <p>The attack vector was identified as a Reflected XSS.</p> <p>Norman API propagates malicious payloads from user input to the UI, which renders the output. For example, a malicious URL gets rendered into a script that is executed on a page.</p> <p>The changes addressed by this fix are: - Encode input that comes from the request URL before adding it to the response. - The request input is escaped by changing the URL construction that is used for links to use `url.URL`. - The request input is escaped by escaping the JavaScript and CSS variables with attribute encoding as defined by [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-rules-summary).</p> <p>### Patches Patched versions include the following commits:</p> <p>| Branch | Commit | | -------- | ------- | | master | 3bb70b7 | | release/v2.8 | a6a6cf5 | | release/v2.7 | cb54924 | | release/v2.7.s3 | 7b2b467 | | release/v2.6 | bd13c65 |</p> <p>### Workarounds There is no direct mitigation besides updating Norman API to a patched version.</p> <p>### References If you have any questions or comments about this advisory:</p> <p>- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for secur…</p> https://cve.radiocsirt.org/vuln/ghsa-r8f4-hv23-6qp6 https://cve.radiocsirt.org/vuln/gsd-2023-32193 gsd-2023-32193 https://cve.radiocsirt.org/vuln/gsd-2023-32193 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0332 <p>Ein Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Informationen offenzulegen, XSS-Angriffe durchzuführen oder seine Privilegien zu erweitern.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Informationen offenzulegen, XSS-Angriffe durchzuführen oder seine Privilegien zu erweitern.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0332