Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2020-35305: GOLLUM.COM may be available for sale or other proposals

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the ‘New Page’ dialog.

CVE
#xss

You have arrived

Congratulations! You are now the proud owner of GOLLUM.COM. As the news spread amongst your partners, employees, and customers, your mobile is ringing for three days. You’ve got a huge number of calls, a mailbox full of messages and congrats. Everything is looking good but you need a bit of time, to process it all, to see the numbers.

It has now been six months and the numbers are in! 40% increase in direct traffic, then shortly after the number is 70%. Repeat customers have grown well over 200%. Who would have thought? Increased trust, word of mouth, no traffic leaks, an important immunity against another brand who may grab the domain, better SEO and more effective marketing campaigns. You didn’t even realize you were missing on all of those before.

It’s been a year now. You sit back and reflect, you’ve spent three months and a small fortune to acquire GOLLUM.COM, and looking back you conclude, it was the best investment you have ever made.

I hope you enjoyed the journey. While the story is fictional, it is based on real people and real events, all of which are listed below.

Related news

GHSA-fj2w-qmjp-3rjm: Gollum 5.0 before 5.1.2 vulnerable to cross-site scripting via filename parameter to New Page dialog

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907