Roundup Cross-site Scripting (XSS) vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2012-6130 · ADVISORY
• bugzilla.redhat.com/show_bug.cgi · WEB
• exchange.xforce.ibmcloud.com/vulnerabilities/84189 · WEB
• pypa/advisory-database · WEB
• roundup-tracker/roundup · PACKAGE
• pypi.python.org/pypi/roundup/1.4.20 · WEB
• issues.roundup-tracker.org/issue2550684 · WEB
• openwall.com/lists/oss-security/2012/11/10/2 · WEB
• openwall.com/lists/oss-security/2013/02/13/8 · WEB
• GitHub Advisory GHSA-mccq-3m7h-fjxg · ADVISORY

roundup 的其他漏洞

• CVE-2025-53865中危 6.4In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
• CVE-2024-39126中危 5.4Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
• CVE-2024-39125中危 5.4Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
• CVE-2024-39124中危 5.4In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
• CVE-2012-6133中危 6.1Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML v…