https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:09:51 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-36446 EUVD-2026-36446 https://cve.radiocsirt.org/vuln/euvd-2026-36446 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5223 <p>In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 &amp; v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.</p> <p>In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3.2 &amp; v1.2.2. Admins are urged to upgrade to these versions to protect the affected users.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-5223 https://cve.radiocsirt.org/vuln/ghsa-8j72-p2wm-6738 <p><strong>Affected:</strong> Packagist: privatebin/privatebin</p> <p>On 24th of December 2019 one of the [property based unit tests](https://github.com/PrivateBin/PrivateBin/blob/master/tst/README.md#property-based-unit-testing) reported a [failure](https://travis-ci.org/PrivateBin/PrivateBin/jobs/629180605#L782). Upon investigation, [@elrido](https://github.com/elrido) discovered that the failure was due to unescaped HTML, which allowed the user provided attachment file name to inject HTML under certain conditions leading to a persistent [Cross-site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting) vulnerability. After committing an [initial fix](https://github.com/PrivateBin/PrivateBin/commit/8d0ac336d23cd8c98e71d5f21cdadcae9c8a26e6) to the master branch, the [issue was reported](https://github.com/PrivateBin/PrivateBin/issues/554) on 25th of December. Vulnerability write-up done by [@rugk](https://github.com/rugk) and [@elrido](https://github.com/elrido). The vulnerability has been fixed in [PrivateBin v1.3.2 &amp; v1.2.2](https://privatebin.info/news/v1.3.2-v1.2.2-release.html). Admins are urged to upgrade to these versions to protect the affected users.</p> <p>## Affected versions</p> <p>Any PrivateBin version since 1.2.</p> <p>## Conditions</p> <p>* The configuration setting `fileupload` has to be enabled, as 1.3 displays an error when trying to open a paste with attachment. * The CSP header rules don&#39;t get applied. For example: * They are unsupported or disabled in the visitors browser. * They are filtered out by a some proxy server at th…</p> <p><strong>Affected:</strong> Packagist: privatebin/privatebin</p> <p>On 24th of December 2019 one of the [property based unit tests](https://github.com/PrivateBin/PrivateBin/blob/master/tst/README.md#property-based-unit-testing) reported a [failure](https://travis-ci.org/PrivateBin/PrivateBin/jobs/629180605#L782). Upon investigation, [@elrido](https://github.com/elrido) discovered that the failure was due to unescaped HTML, which allowed the user provided attachment file name to inject HTML under certain conditions leading to a persistent [Cross-site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting) vulnerability. After committing an [initial fix](https://github.com/PrivateBin/PrivateBin/commit/8d0ac336d23cd8c98e71d5f21cdadcae9c8a26e6) to the master branch, the [issue was reported](https://github.com/PrivateBin/PrivateBin/issues/554) on 25th of December. Vulnerability write-up done by [@rugk](https://github.com/rugk) and [@elrido](https://github.com/elrido). The vulnerability has been fixed in [PrivateBin v1.3.2 &amp; v1.2.2](https://privatebin.info/news/v1.3.2-v1.2.2-release.html). Admins are urged to upgrade to these versions to protect the affected users.</p> <p>## Affected versions</p> <p>Any PrivateBin version since 1.2.</p> <p>## Conditions</p> <p>* The configuration setting `fileupload` has to be enabled, as 1.3 displays an error when trying to open a paste with attachment. * The CSP header rules don&#39;t get applied. For example: * They are unsupported or disabled in the visitors browser. * They are filtered out by a some proxy server at th…</p> https://cve.radiocsirt.org/vuln/ghsa-8j72-p2wm-6738 https://cve.radiocsirt.org/vuln/gsd-2020-5223 gsd-2020-5223 https://cve.radiocsirt.org/vuln/gsd-2020-5223