https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:40:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-196013 EUVD-2026-196013 https://cve.radiocsirt.org/vuln/euvd-2026-196013 https://cve.radiocsirt.org/vuln/fkie_cve-2023-32192 <p>A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server&#39;s public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser</p> <p>A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server&#39;s public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-32192 https://cve.radiocsirt.org/vuln/ghsa-833m-37f7-jq55 <p><strong>Affected:</strong> Go: github.com/rancher/apiserver</p> <p>### Impact A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server&#39;s public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.</p> <p>The attack vector was identified as a Reflected XSS.</p> <p>API Server propagates malicious payloads from user input to the UI, which renders the output. For example, a malicious URL gets rendered into a script that is executed on a page.</p> <p>The changes addressed by this fix are: - Encode input that comes from the request URL before adding it to the response. - The request input is escaped by changing the URL construction that is used for links to use `url.URL`. - The request input is escaped by escaping the JavaScript and CSS variables with attribute encoding as defined by [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-rules-summary).</p> <p>### Patches Patched versions include the following commits:</p> <p>| Branch | Commit | | -------- | ------- | | master | 4fd7d82 | | release/v2.8 | 69b3c2b | | release/v2.8.s3 | a3b9e37 | | release/v2.7 | 4e102cf | | release/v2.7.s3 | 97a10a3 | | release/v2.6 | 4df268e |</p> <p>### Workarounds There is no direct mitigation besides updating API Server to a patched version.</p> <p>### References If you have any questions or comments about this advisory:</p> <p>- Reach out to the [SUSE Rancher Security team](https://github.com/ranc…</p> <p><strong>Affected:</strong> Go: github.com/rancher/apiserver</p> <p>### Impact A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server&#39;s public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.</p> <p>The attack vector was identified as a Reflected XSS.</p> <p>API Server propagates malicious payloads from user input to the UI, which renders the output. For example, a malicious URL gets rendered into a script that is executed on a page.</p> <p>The changes addressed by this fix are: - Encode input that comes from the request URL before adding it to the response. - The request input is escaped by changing the URL construction that is used for links to use `url.URL`. - The request input is escaped by escaping the JavaScript and CSS variables with attribute encoding as defined by [OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding-rules-summary).</p> <p>### Patches Patched versions include the following commits:</p> <p>| Branch | Commit | | -------- | ------- | | master | 4fd7d82 | | release/v2.8 | 69b3c2b | | release/v2.8.s3 | a3b9e37 | | release/v2.7 | 4e102cf | | release/v2.7.s3 | 97a10a3 | | release/v2.6 | 4df268e |</p> <p>### Workarounds There is no direct mitigation besides updating API Server to a patched version.</p> <p>### References If you have any questions or comments about this advisory:</p> <p>- Reach out to the [SUSE Rancher Security team](https://github.com/ranc…</p> https://cve.radiocsirt.org/vuln/ghsa-833m-37f7-jq55 https://cve.radiocsirt.org/vuln/gsd-2023-32192 gsd-2023-32192 https://cve.radiocsirt.org/vuln/gsd-2023-32192 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0332 <p>Ein Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Informationen offenzulegen, XSS-Angriffe durchzuführen oder seine Privilegien zu erweitern.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Rancher ausnutzen, um Informationen offenzulegen, XSS-Angriffe durchzuführen oder seine Privilegien zu erweitern.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0332