CVE-2022-34530

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames...

CVE-2022-34530

CVE-2022-34530 affects Backdrop CMS v1.22.0. The issue lies in the login and password reset flow, allowing an attacker to enumerate usernames via password reset requests and receive distinct responses based on the username. The provided documents note a low confidentiality impact but do not speci...

PT-2022-22191 · Unknown · Backdrop Cms

Name of the Vulnerable Software and Affected Versions: Backdrop CMS version 1.22.0 Description: An issue in the login and reset password functionality allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames. Recommendations: For...

Backdrop CMS 授权问题漏洞

Backdrop CMS is an open source content management system CMS. An authorization issue vulnerability exists in Backdrop CMS v1.22.0, which stems from a problem with the login and reset password functionality that allows an attacker to enumerate usernames via a password reset request and a different...

CVE-2022-34530: Weak Password Recovery Mechanism for Forgotten Password

An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames...

Backdrop CMS Cross-Site Request Forgery Vulnerability

Backdrop CMS is an open source content management system CMS. A cross-site request forgery vulnerability exists in Backdrop CMS, which stems from obtaining remote code execution RCE on a hosted web server by uploading a malicious add-on with a crafted PHP file. No details of the vulnerability are...

CVE-2021-45268

A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cook...

CVE-2021-45268

A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cook...

CVE-2021-45268

A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cook...

Cross site request forgery (csrf)

DISPUTED A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a...

CVE-2021-45268

CVE-2021-45268 concerns Backdrop CMS 1.20 with a CSRF vulnerability that can lead to remote code execution on the hosting server by uploading a crafted PHP add-on. The vendor notes the attack requires a high-privileged authenticated user with permission to install add-ons. Multiple sources (NVD, ...

PT-2022-12317 · Unknown · Backdrop Cms

Name of the Vulnerable Software and Affected Versions: Backdrop CMS version 1.20 Description: A Cross Site Request Forgery CSRF issue exists, allowing remote attackers to gain Remote Code Execution RCE on the hosting web server via uploading a malicious add-on with a crafted PHP file. The attack...

CVE-2021-45268: Cross-Site Request Forgery (CSRF)

A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cook...

Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery (CSRF)

Exploit Title: Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery CSRF Exploit Author: V1n1v131r4 Date: 2021-09-22 Vendor Homepage: https://backdropcms.org/ Software Link: https://github.com/backdrop/backdrop/releases/download/1.20.0/backdrop.zip Version: 1.20.0 Tested On: Kali Linux,...

Backdrop CMS 1.20.0 Cross Site Request Forgery / Command Execution

Exploit Title: Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery CSRF Exploit Author: V1n1v131r4 Date: 2021-09-22 Vendor Homepage: https://backdropcms.org/ Software Link: https://github.com/backdrop/backdrop/releases/download/1.20.0/backdrop.zip Version: 1.20.0 Tested On: Kali Linux,...

Backdrop CMS 1.20.0 - Multiple Cross-Site Request Forgery Vulnerability

Exploit Title: Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery CSRF Exploit Author: V1n1v131r4 Vendor Homepage: https://backdropcms.org/ Software Link: https://github.com/backdrop/backdrop/releases/download/1.20.0/backdrop.zip Version: 1.20.0 Tested On: Kali Linux, Ubuntu 20.04...

Backdrop CMS 后置链接漏洞

Backdrop CMS is an open source content management system CMS. A backlink vulnerability exists in Backdrop CMS. The vulnerability stems from the use of the third-party PEAR ArchiveTar library and could allow a remote attacker to execute arbitrary code on the system...

Huawei EulerOS: Security Advisory for pki-core (EulerOS-SA-2021-1346)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the backdrop-filter function in the WebKit CSS module for rendering web pages allows a hacker to induce a service failure through a specially crafted HTML page.

The vulnerability of the backdrop-filter function in the WebKit CSS rendering component is related to the high resource consumption required for processing div elements. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially crafted HTML page...

VulnCheck KEV: CVE-2019-11358

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extendtrue, , ... because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype...