Most recent entries from all

bdu:2025-01561

EUVD-2026-273002

fkie_cve-2024-52281

A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4.

GHSA-2v2w-8v8c-wcm9 — Rancher UI has Stored Cross-site Scripting vulnerability

Affected: Go: github.com/rancher/rancher

### Impact A vulnerability has been identified within Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field.

Please consult the associated [MITRE ATT&CK - Technique - Drive-by Compromise](https://attack.mitre.org/techniques/T1189/) for further information about this category of attack.

### Patches The fix introduces new changes in the directives responsible for sanitizing HTML code before rendering.

We replaced the `v-tooltip` directive with the `v-clean-tooltip` directive.

Patched versions include releases `2.9.4` and `2.10.0`.

### Workarounds There are no workarounds for this issue. Users are recommended to upgrade, as soon as possible, to a version of /Rancher Manager which contains the fixes.

### Credits This issue was identified and reported by Bhavin Makwana from Workday’s Cyber Defence Team.

### For more information If you have any questions or comments about this advisory: - Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries. - Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository. - Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).

openSUSE-SU-2025:14653-1 — govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media

govulncheck-vulndb-0.0.20250115T172141-1.1 on GA media

SUSE-SU-2025:0297-1 — Security update for govulncheck-vulndb

Security update for govulncheck-vulndb

WID-SEC-W-2025-0075 — Rancher: Schwachstelle ermöglicht Cross-Site Scripting

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Rancher ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.