732 matches found
CVE-2021-3988
A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...
CVE-2021-3986
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...
CVE-2021-3988
A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...
CVE-2021-3986
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...
CVE-2021-3987
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...
CVE-2021-3988 Cross-site Scripting (XSS) in janeczku/calibre-web
A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...
CVE-2021-3988
CVE-2021-3988 affects janeczku/calibre-web. The XSS occurs in edit_books.js when editing book properties (e.g., uploading a cover/format) via the #btn-upload-cover handler, where user input is inserted into the DOM without sanitization. This can permit arbitrary JavaScript execution and cookie th...
CVE-2021-3988 Cross-site Scripting (XSS) in janeczku/calibre-web
A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...
CVE-2021-3987 Improper Access Control in janeczku/calibre-web
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...
CVE-2021-3987
CVE-2021-3987 (janeczku/calibre-web) is an improper access control flaw where the public shelf creation path (shelf.py: create_shelf) does not verify user permissions, allowing low-privilege users to create public shelves and perform unauthorized actions. Public disclosures in multiple feeds corr...
CVE-2021-3987 Improper Access Control in janeczku/calibre-web
An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...
CVE-2021-3986
The CVE-2021-3986 issue in janeczku/calibre-web is a data exposure vulnerability where an unauthorized user can view the names of private shelves. It occurs in shelf.py at line 221, exposing the shelf name in an error message when a non-owner tries to remove a book. This affects all versions prio...
CVE-2021-3986 Information Disclosure in janeczku/calibre-web
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...
CVE-2021-3986 Information Disclosure in janeczku/calibre-web
A vulnerability in janeczku/calibre-web allows unauthorized users to view the names of private shelves belonging to other users. This issue occurs in the file shelf.py at line 221, where the name of the shelf is exposed in an error message when a user attempts to remove a book from a shelf they d...
Calibre-Web 访问控制错误漏洞
Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B, an individual developer. An access control error vulnerability exists in Calibre-Web that stems from the createshelf method in shelf.py not verifying that a user has the required...
Calibre-Web 跨站脚本漏洞
Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B, an individual developer. Calibre-Web suffers from a cross-site scripting vulnerability that originates from inserting user input directly into the DOM without proper cleanup. An...
Calibre-Web 安全漏洞
Calibre-Web is a web application for browsing, reading, and downloading eBooks from the Calibre database by Jan B Individual Developer. A security vulnerability exists in Calibre-Web that originates from allowing unauthorized users to view the names of private bookshelves belonging to other users...
calibre: Multiple Vulnerabilities
Background calibre is a powerful and easy to use e-book manager. Description Multiple vulnerabilities have been discovered in calibre. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...
GLSA-202409-04 : calibre: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202409-04 calibre: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in calibre. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...
