Zen
Monthly
Stored cross-site scripting in sheshbabu zen (versions 1.0 through 1.5.0) allows an authenticated low-privilege user to store crafted content that is later rendered by features/notes/NotesEditor.jsx through React's dangerouslySetInnerHTML without sanitization, executing script in the browser of anyone who opens the affected note. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no vendor-released patch has been identified. Impact is limited to integrity in the affected web origin (scope change, low confidentiality/integrity, no availability impact), which keeps this a low-to-moderate priority issue for self-hosted instances.
If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Update 5 for Zen 14 SP2 (v14.21.022), it. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Actian Pervasive PSQL v12.10 and Zen v13 allows remote attackers to execute arbitrary code via crafted traffic to TCP port 1583. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable.
Stored cross-site scripting in sheshbabu zen (versions 1.0 through 1.5.0) allows an authenticated low-privilege user to store crafted content that is later rendered by features/notes/NotesEditor.jsx through React's dangerouslySetInnerHTML without sanitization, executing script in the browser of anyone who opens the affected note. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no vendor-released patch has been identified. Impact is limited to integrity in the affected web origin (scope change, low confidentiality/integrity, no availability impact), which keeps this a low-to-moderate priority issue for self-hosted instances.
If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Update 5 for Zen 14 SP2 (v14.21.022), it. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Actian Pervasive PSQL v12.10 and Zen v13 allows remote attackers to execute arbitrary code via crafted traffic to TCP port 1583. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.
Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable.