#web

### Summary There is a cross-site scripting vulnerability on To-Do that affects a title field of a To-Do.

### Summary HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address.

### Description Leantime allows stored cross-site scripting (XSS) in the API key name while generating the API key. ### Impact Any low privileged user like manager, or editor, can create an API key with XSS payload. When admin will visit the Company page, the XSS will automatically get triggerred leading to the unauthorized action performed from the ADMIN account. Like, removing any user, or adding someone else as high privilege, and many more.

**CSRF** ### Summary A cross-site request forgery vulnerability allows a remote actor to create an account with Owner privileges. By luring an Owner or Administrator into clicking a button on an attacker-controlled website, a request will be issued, generating an account with the attacker's information and role of their choosing. ### Impact While the likelihood of a successful exploit is low, the impact would be high as the attacker could then gain complete control over the victim's environment.

### Summary Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. ### Details A Stored Cross-Site Scripting (XSS) vulnerability was found that could potentially compromise user data and pose a significant security risk to the platform. ### PoC - Create a project - Navigate to project - Visit to the integration - Add malicious payload inside the webhook and save it. - Notice the alert dialogue indicating successful execution of the XSS payload. ``` '';!--" onfocus=alert(0) autofocus="" onload=alert(3);="&{(alert(1))}" |="" mufazmi"=" ``` ``` '';!--" onfocus=alert(0) autofocus="" onload=alert(3);=>>"&{(alert(1))}" |="">> mufazmi"=">> ``` ### POC https://youtu.be/kqKFgsOqstg ### Impact This XSS vulnerability allows an attacker to execute malicious scripts in the context of a victim's browser when they click on a specially crafted link. This could lead to various m...

STORED XSS +OPEN REDIRECTION in SVG uploads Vulnerable url:https://hack.leantime.io/projects/showProject/3

### Impact An authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. ### Patches This problem has been patched and exists in versions 1.49.1 and below ### Workarounds On S3 backends, configure ```yaml # ... blockstore: s3: disable_pre_signed_multipart: true ``` or set environment variable `LAKEFS_BLOCKSTORE_S3_DISABLE_PRE_SIGNED_MULTIPART` to `true`. ### References _Are there any links users can visit to find out more?_

TopSec data leak: 7000+ documents expose potential Chinese government surveillance and censorship practices. Learn about the key findings…

The cybersecurity lead for VA.gov was fired last week. He tells WIRED that the Veterans Affairs digital hub will be more vulnerable without someone in his role.

Healthcare security is failing patients time and again. This week DM Clinical Research and Helath Net Federal Services take the spotlight