CVE-2018-14520

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages...

PT-2022-8036 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby version 2.5.12 Description: The issue allows malicious HTTP requests to be sent, which can trick a user into adding web pages. Recommendations: For Kirby version 2.5.12, at the moment, there is no information about a newer version that...

Critical: openldap

Issue Overview: In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of...

GHSA-3GQ5-R59M-MMV2 Kirby XSS Vulnerability

Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file...

CVE-2021-36778

A Incorrect Authorization vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3...

AZL-45177 CVE-2018-25032 affecting package teckit for versions less than 2.5.12-4

zlib before 1.2.12 allows memory corruption when deflating i.e., when compressing if the input has many distant matches...

Xxe

openHAB is a vendor and technology agnostic open source automation software for your home. In openHAB before versions 2.5.12 and 3.0.1 the XML external entity XXE attack allows attackers in the same network as the openHAB instance to retrieve internal information like the content of files from th...

CVE-2018-16630

Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file...

GHSA-X5X7-3V85-WPC4 Apache Struts allows entering a custom URL in a form field if built-in URLValidator is used

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this...

GHSA-8MR5-H28G-36QX Spring AOP functionality (Struts) vulnerable to DoS attack

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33...

Kirby CMS 2.5.12 - Cross-Site Request Forgery (Delete Page)

Exploit Title: Kirby CMS 2.5.12 - Cross-Site Request Forgery Delete Page Date: 2018-07-22 Exploit Author: Zaran Shaikh Version: 2.5.12 CVE: NA Category: Web Application 1. Description The application allows malicious HTTP requests to be sent in order to trick a user into adding/ deleting web page...

Kirby CMS 2.5.12 - Cross-Site Request Forgery (Delete Page)

Kirby CMS 2.5.12 - Cross-Site Request Forgery Delete Page Exploit Title:​​ Kirby CMS 2.5.12 - Cross-Site Request Forgery Delete Page Date: 2018-07-22 Exploit Author: Zaran Shaikh Version: 2.5.12 CVE: NA Category: Web Application 1. Description The application allows malicious HTTP requests to be...

Kirby CMS 2.5.12 - Cross-Site Scripting

Kirby CMS 2.5.12 - Cross-Site Scripting Exploit Title:​​ Kirby CMS 2.5.12 - Cross-Site Scripting Date: 2018-07-22 Exploit Author: Zaran Shaikh Version: ​2.5.12 CVE : ​NA Category: ​Web Application Description The application allows user injected payload which can lead to Stored Cross Site...

Apache Struts DoS Vulnerability (S2-044) - Linux

Apache Struts is prone to a Denial of Service DoS vulnerability. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2017-9804

In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this...

CVE-2017-9804

CVE-2017-9805 affects Apache Struts 2 with the REST plugin that uses an XStreamHandler for XML deserialization without type filtering. The vulnerability allows remote code execution when processing crafted XML payloads. Affected versions are Apache Struts 2.x prior to 2.3.34 and 2.5.x prior to 2....

Apache Struts Security Update (S2-053) - Active Check

Apache Struts is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BSA-2017-428

Security Advisory ID : BSA-2017-428 Component : Apache Struts Revision : 2.0: Interim The previous fix issued with CVE-2017-7672 was incomplete. If an application allows enter an URL in a form field and built-inURLValidatoris used, it is possible to prepare a special URL which will be used to...

CVE-2017-7672

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12...

Code injection

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12...