Bug #17010
Updated by Jim Pingle 2 days ago
The Suricata SID Management Configuration List page at @suricata_sid_mgmt.php@ does not encode filenames before display. Uploading a SID Management Configuration List file with a name such as the following can trigger an XSS on the page: @xsstest123<img src=x onerror=alert(String.fromCharCode(88,83,83))>.txt@ Reported by: @lujiefsi