CVE-2024-35180 — OMERO.web JSONP callback vulnerability
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web…
Published: 2024-05-21 · CVSS: 6.1 · CVSS 3.1
OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7