GHSA-HXJ6-V58R-CQV3 Cross Site Scripting in Subrion CMS

Cross Site Scripting XSS vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 93 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 93.0.4577.63 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcoming...

Cachet vulnerable to new line injection during configuration edition

Impact Authenticated users, regardless of their privileges User or Admin, can exploit a new line injection in the configuration edition feature e.g. mail settings and gain arbitrary code execution on the server. Patches This issue was addressed by improving UpdateConfigCommandHandler and preventi...

Excellent Write-up of the SolarWinds Security Breach

Robert Chesney wrote up the Solar Winds story as a case study, and its a really good summary...

Premium Addons for Elementor < 4.5.2 - Subscriber+ Arbitrary Blog Option Update

The plugin does not have any CSRF and authorisation checks in the padismissadminnotice AJAX action, available to any authenticated users, and do not validate the option key to ensure the option to update belongs to the plugin. As a result, any authenticated user, such as subscriber can update...

Premium Addons for Elementor < 4.5.2 - Subscriber+ Arbitrary Blog Option Update

The plugin does not have any CSRF and authorisation checks in the padismissadminnotice AJAX action, available to any authenticated users, and do not validate the option key to ensure the option to update belongs to the plugin. As a result, any authenticated user, such as subscriber can update...

CVE-2020-18998

Cross Site Scripting XSS in Blogmini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/add'...

CVE-2020-18998

Cross Site Scripting XSS in Blogmini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/add'...

CVE-2020-19002

Cross Site Scripting XSS in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632...

PYSEC-2021-343

Cross Site Scripting XSS in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632...

CVE-2020-19002

Cross Site Scripting XSS in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632...

CVE-2020-19002

Cross Site Scripting XSS in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632...

CVE-2020-18998

Cross Site Scripting XSS in Blogmini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/add'...

CVE-2020-18998

CVE-2020-18998 affects Blog_mini v1.0 through the vulnerable path /admin/custom/blog-plugin/add where a cross-site scripting (XSS) flaw enables remote attackers to execute arbitrary code. This is supported by multiple sources (NVD/NVD-derived entries, CNVD, OSV, Red Hat advisory) describing the s...

PT-2021-10266

Name of the Vulnerable Software and Affected Versions: Blog mini version 1.0 Description: The issue allows remote attackers to execute arbitrary code via the component "/admin/submit-articles". This is a Cross Site Scripting XSS issue. Recommendations: For Blog mini version 1.0, consider disablin...

PT-2021-10265

Name of the Vulnerable Software and Affected Versions: Blog mini version 1.0 Description: The issue allows remote attackers to execute arbitrary code via the component "/admin/custom/blog-plugin/add". This is a Cross Site Scripting XSS issue. Recommendations: For Blog mini version 1.0, consider...

PT-2021-10270

Name of the Vulnerable Software and Affected Versions: Mezzanine version 4.3.1 Description: The issue allows remote attackers to execute arbitrary code via the Description field of the component admin/blog/blogpost/add/. Recommendations: For Mezzanine version 4.3.1, as a temporary workaround,...

Mezzanine cross-site scripting vulnerabilities

Github Mezzanine, a content management platform, is vulnerable to a cross-site scripting vulnerability that originates from a cross-site scripting XSS vulnerability in Mezzanine v4.3.1. The vulnerability can be exploited to execute arbitrary code via the "Description" field of...

CVE-2020-19002: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632...

CVE-2020-18998: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Blogmini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/add'...