https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:06:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-222084 EUVD-2026-222084 https://cve.radiocsirt.org/vuln/euvd-2026-222084 https://cve.radiocsirt.org/vuln/fkie_cve-2024-52812 <p>LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim&#39;s browser. Version 2.0.8 fixes the issue.</p> <p>LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim&#39;s browser. Version 2.0.8 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-52812 https://cve.radiocsirt.org/vuln/ghsa-6hrw-x7pr-4mp8 <p><strong>Affected:</strong> Go: github.com/lf-edge/ekuiper/v2, Go: github.com/lf-edge/ekuiper</p> <p>### Summary Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users&#39; browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.</p> <p>### Details</p> <p>A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Rule `id` parameter. Then, after any user with access to this service (e.g. admin) will try make any modifications with the rule (update, run, stop, delete), a payload will act in victim&#39;s browser.</p> <p>The issue appears as the notification to user is made in an insafe way:</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824</p> <p>Such writing to &#39;http.ResponseWriter&#39; bypasses HTML escaping that prevents cross-site scrip…</p> <p><strong>Affected:</strong> Go: github.com/lf-edge/ekuiper/v2, Go: github.com/lf-edge/ekuiper</p> <p>### Summary Stored Cross-Site Scripting (XSS) vulnerability allows attackers to inject malicious scripts into web applications, which can then be executed in the context of other users&#39; browsers. This can lead to unauthorized access to sensitive information, session hijacking, and spreading of malware, impacting user data privacy and application integrity.</p> <p>### Details</p> <p>A user with rights to modificate the service (e.g. kuiperUser role) can inject XSS Payload into Rule `id` parameter. Then, after any user with access to this service (e.g. admin) will try make any modifications with the rule (update, run, stop, delete), a payload will act in victim&#39;s browser.</p> <p>The issue appears as the notification to user is made in an insafe way:</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L681</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L716</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L735</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L794</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L809</p> <p>https://github.com/lf-edge/ekuiper/blob/dbce32d5a195cf1de949b3a6a4e29f0df0f3330d/internal/server/rest.go#L824</p> <p>Such writing to &#39;http.ResponseWriter&#39; bypasses HTML escaping that prevents cross-site scrip…</p> https://cve.radiocsirt.org/vuln/ghsa-6hrw-x7pr-4mp8 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14893-1 <p>govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14893-1