Hi,
On Fri, 4 Oct 2024 17:19:21 +0200 =?UTF-8?Q?Moritz_M=C3=BChlenhoff?= <
jmm@inutil.org> wrote:
CVE-2024-6485[1]:
| A security vulnerability has been discovered in bootstrap that could
| enable Cross-Site Scripting (XSS) attacks. The vulnerability is
| associated with the data-loading-text attribute within the button
| plugin. This vulnerability can be exploited by injecting malicious
| JavaScript code into the attribute, which would then be executed
| when the button's loading state is triggered.
https://www.herodevs.com/vulnerability-directory/cve-2024-6485
Possible fix for CVE-2024-6485 (not CVE-2024-6484) in a bootstrap3 fork:
https://github.com/entreprise7pro/bootstrap/commit/769c032fd93d6f2c07599e096a736c5d09c041cf
(thanks Bastien for the pointer)
WDYT?
Cheers!
Sylvain Beucler
Debian LTS Team
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)