calibre-web 安全漏洞

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. A security vulnerability exists in calibre-web that stems from the fact that calibre-web is prone to business logic errors...

Calibre-Web 跨站请求伪造漏洞

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. A cross-site request forgery vulnerability exists in calibre-web, which stems from the software's lack of validation of cross-site request forgery tokens...

PT-2022-11465

Name of the Vulnerable Software and Affected Versions calibre-web affected versions not specified Description The issue is related to Business Logic Errors. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was...

CVE-2021-4170

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-4170

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-4170

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross site scripting

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-4170

CVE-2021-4170 affects the Calibre-Web web application, with vulnerability described as Improper Neutralization of Input During Web Page Generation (Cross-site Scripting). The provided documents consistently attribute XSS to insufficient neutralization of user input during page generation, affecti...

CVE-2021-4170 Cross-site Scripting (XSS) - Stored in janeczku/calibre-web

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Calibre-Web 跨站脚本漏洞

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database.A vulnerability exists in Calibre-Web cross-site scripting that is vulnerable to incorrect neutralization of input during web page generation. No details of the vulnerability are currently...

PT-2022-11464

Name of the Vulnerable Software and Affected Versions calibre-web affected versions not specified Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software does not properly neutralize user...

MGASA-2021-0593 Updated calibre packages fix security vulnerability

ReDoS vulnerability in htmlpreprocessrules in ebooks/conversion/preprocess.py...

Updated calibre packages fix security vulnerability

ReDoS vulnerability in htmlpreprocessrules in ebooks/conversion/preprocess.py...

Fedora: Security Advisory for calibre (FEDORA-2021-e42fadbcc3)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 34 Update: calibre-4.23.0-8.fc34

Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the...

Cross-site Scripting (XSS) - Stored in janeczku/calibre-web

Description Missing input check on Identifiers lead to stored XSS. Steps to reproduce 1. 1. Any book - Edit metadata - Identifiers 2. 2. Set any value to the first field and javascript:alertdocument.domain to the second one. 3. 3. Save the book, select it, click on Identifier - XSSed! Proof of...

Server-Side Request Forgery (SSRF) in janeczku/calibre-web

Title Blind SSRF via URL fetch Summary calibre-web allows external URL fetching in order to upload a book cover. However, instead of external URL it is possible to point to localhost, which will be reached resulting in blind SSRF. Steps to reproduce 1. 1. As an admin give permissions to upload...

Cross-Site Request Forgery (CSRF) in janeczku/calibre-web

Description CSRF on various endpoints Summary Pretty recently CSRF protection in calibre-web was implemented. However, there are some state-changing endpoints that accept GET requests instead of POST. The most impactful route so far, that allows to completely shutdown the server:...

Regular Expression Denial Of Service(ReDoS)

calibre is vulnerable to regular expression denial of serviceReDoS. An attacker is able to hang the application via vulnerable htmlpreprocessrules in ebooks/conversion/preprocess.py...

Unspecified vulnerability in calibre

Calibre is an open source free all-in-one eBook reading management and format conversion tool. A security vulnerability exists in calibre before 5.32.0, which stems from the inclusion of regular expressions vulnerable to ReDoS Regular Expression Denial of Service attacks in htmlpreprocessrules in...