## Summary The `DisallowedRawHtml` extension does not escape a disallowed tag when the tag name is the last thing in the raw HTML. A Markdown line containing just `<script` is emitted unchanged, and the next block can supply its attributes. With the shipped GFM defaults this allows stored XSS by anyone who can post Markdown. ## Details `DisallowedRawHtmlRenderer` escapes tags with this regex: ``` /<(\/?(?:title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext)[\s\/>])/i ``` The
Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recomme
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.
The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on sessio
## Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container memory limit. No authentication, no credentials, and no valid message are required. Applications are affected only if they start a microservice with `Transport.TCP` and the transport's port is reachable by an untrusted peer. ## Affected v
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.
Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.
Contributor Cross Site Scripting (XSS) in The Plus Addons for Elementor Page Builder Lite <= 6.5.1 versions.
Subscriber Bypass Vulnerability in All In One WP Security & Firewall <= 5.4.8 versions.
Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions.
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.