469 matches found
CVE-2020-8812
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug...
CVE-2020-8811
ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures...
CVE-2020-8812
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug...
Code injection
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug...
Design/Logic Flaw
ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures...
CVE-2020-8811
ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures...
CVE-2020-8811
CVE-2020-8811 affects Bludit 3.10.0. The vulnerability lies in ajax/profile-picture-upload.php, where an authenticated user can change other users' profile pictures. This is the stated impact; no remediation details are provided in the connected documents. CVSS metrics in the initial record indic...
CVE-2020-8811
ajax/profile-picture-upload.php in Bludit 3.10.0 allows authenticated users to change other users' profile pictures...
CVE-2020-8812
Bludit 3.10.0 allows Editor or Author roles to insert malicious JavaScript on the WYSIWYG editor. NOTE: the vendor's perspective is that this is "not a bug...
CVE-2020-8812
Summary of CVE-2020-8812 : Bludit 3.10.0 contains an issue where users with Editor or Author roles can insert malicious JavaScript via the WYSIWYG editor. The root cause, as described across connected documents, is lack of proper input validation/execution control in the editor, enabling client-s...
PT-2020-20298 · Bludit · Bludit
Name of the Vulnerable Software and Affected Versions: Bludit version 3.10.0 Description: The issue allows users with Editor or Author roles to insert malicious JavaScript into the WYSIWYG editor. It's noted that the vendor considers this behavior as "not a bug". Recommendations: For Bludit versi...
Bludit - Directory Traversal Image File Upload Exploit
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Bludit Directory Traversal Image File Upload Vulnerability", 'Description' = %q This module exploits a vulnerability in Bludit. A remote user cou...
Bludit - Directory Traversal Image File Upload (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Bludit Directory Traversal Image File Upload Vulnerability", 'Description' = %q This module exploits a vulnerability in Bludit. A remote user cou...
Bludit Directory Traversal Image File Upload
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Bludit Directory Traversal Image File Upload Vulnerability", 'Description' = %q This module exploits a vulnerability in Bludit. A remote user cou...
Bludit Brute Force Protection Mechanism Bypass Vulnerability
Bludit is a simple, fast and secure flat file CMS. A brute force protection mechanism bypass vulnerability exists in bl-kernel/security.class.php in Bludit 3.9.2, which can be exploited by an attacker to bypass the brute force protection mechanism via a variety of forged X-Forwarded-For or...
CVE-2019-17240
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...
CVE-2019-17240
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...
Design/Logic Flaw
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers...
CVE-2019-17240
Bludit 3.9.2 is affected by CVE-2019-17240 in bl-kernel/security.class.php, enabling bypass of the brute-force protection by forging X-Forwarded-For or Client-IP headers. This authentication bypass vulnerability allows repeated login attempts to bypass rate limiting, potentially leading to creden...