732 matches found
PT-2024-38026 · Calibre · Calibre
Name of the Vulnerable Software and Affected Versions: Calibre versions prior to 7.15.0 Description: The issue is related to unsanitized user-input, allowing attackers to perform reflected cross-site scripting. Recommendations: For Calibre versions prior to 7.15.0, update to version 7.15.0 or lat...
PT-2024-5838 · Calibre · Calibre
Name of the Vulnerable Software and Affected Versions: Calibre versions prior to 7.14.0 Description: The issue is related to path traversal in the software, allowing unauthenticated attackers to achieve arbitrary file read. This is due to incorrect restriction of the directory path name with...
Calibre 安全漏洞
Calibre is an open source and free all-in-one eBook reading management and format conversion tool from the individual developer Kovid Goyal in India. A security vulnerability exists in Calibre version 7.14.0 and prior versions, which stems from a path traversal that allows an unauthenticated...
PT-2024-38027 · Calibre · Calibre
Name of the Vulnerable Software and Affected Versions: Calibre versions prior to 7.15.0 Description: The issue concerns unsanitized user-input, allowing users with permissions to perform full-text searches to achieve SQL injection on the SQLite database. Recommendations: For Calibre versions prio...
PT-2024-5692 · Calibre · Calibre
Name of the Vulnerable Software and Affected Versions: Calibre versions 6.9.0 through 7.14.0 Description: The issue is related to improper access control in the software, which allows unauthenticated attackers to achieve remote code execution. This is due to a vulnerability associated with...
Calibre Python Code Injection (CVE-2024-6782)
This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.15.0. Once enabled disabled by default, it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic, and does not require any...
Cross Site Scripting(XSS)
Calibre-Web is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization performed by the cleanstring function, which allows an attacker perform XSS by inserting a payload into the comments field...
Calibre-Web Cross Site Scripting (XSS)
In janeczku Calibre-Web 0.6.0 to 0.6.21, the editbookcomments function is vulnerable to Cross Site Scripting XSS due to improper sanitization performed by the cleanstring function. The vulnerability arises from the way the cleanstring function handles HTML sanitization...
GHSA-J22R-3RF3-CV25 Calibre-Web Cross Site Scripting (XSS)
In janeczku Calibre-Web 0.6.0 to 0.6.21, the editbookcomments function is vulnerable to Cross Site Scripting XSS due to improper sanitization performed by the cleanstring function. The vulnerability arises from the way the cleanstring function handles HTML sanitization...
CVE-2024-39123
In janeczku Calibre-Web 0.6.0 to 0.6.21, the editbookcomments function is vulnerable to Cross Site Scripting XSS due to improper sanitization performed by the cleanstring function. The vulnerability arises from the way the cleanstring function handles HTML sanitization...
PT-2024-28353
Name of the Vulnerable Software and Affected Versions janeczku Calibre-Web versions 0.6.0 through 0.6.21 Description The issue arises from improper sanitization performed by the clean string function, specifically in the way it handles HTML sanitization, making the edit book comments function...
CVE-2024-39123
In janeczku Calibre-Web 0.6.0 to 0.6.21, the editbookcomments function is vulnerable to Cross Site Scripting XSS due to improper sanitization performed by the cleanstring function. The vulnerability arises from the way the cleanstring function handles HTML sanitization...
CVE-2024-39123
Calibre-Web 0.6.0–0.6.21 is vulnerable to Cross-Site Scripting (XSS) due to improper HTML sanitization in the clean_string function, exploitable via the edit_book_comments feature. Reports from Red Hat and OSV/OSV-GHSA entries corroborate the same root cause: inadequate sanitization leading to XS...
CVE-2024-39123
In janeczku Calibre-Web 0.6.0 to 0.6.21, the editbookcomments function is vulnerable to Cross Site Scripting XSS due to improper sanitization performed by the cleanstring function. The vulnerability arises from the way the cleanstring function handles HTML sanitization...
CVE-2024-39123
In janeczku Calibre-Web 0.6.0 to 0.6.21, the editbookcomments function is vulnerable to Cross Site Scripting XSS due to improper sanitization performed by the cleanstring function. The vulnerability arises from the way the cleanstring function handles HTML sanitization...
Improper Authorization
calibre is vulnerable to Improper Authorization. An attacker could exploit this vulnerability by tricking a user into opening a specially crafted ebook with calibre. The ebook would contain a malicious link that would exploit the flaw in the linktolocalpath function to escalate the attacker's...
SUSE CVE-2023-46303
linktolocalpath in ebooks/conversion/plugins/htmlinput.py in calibre before 6.19.0 can, by default, add resources outside of the document root...
CVE-2023-46303
linktolocalpath in ebooks/conversion/plugins/htmlinput.py in calibre before 6.19.0 can, by default, add resources outside of the document root...
