Calibre 资源管理错误漏洞

Calibre is an open source free all-in-one eBook reading management and format conversion tool. A security vulnerability exists in calibre before 5.32.0, which stems from the inclusion of regular expressions vulnerable to ReDoS Regular Expression Denial of Service attacks in htmlpreprocessrules in...

CVE-2021-44686

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service in htmlpreprocessrules in ebooks/conversion/preprocess.py...

CVE-2021-44686

CVE-2021-44686 affects calibre before 5.32.0. Affected component: html_preprocess_rules in ebooks/conversion/preprocess.py, where a regular expression is vulnerable to ReDoS. Impact is denial of service under crafted input. Mitigation: upgrade calibre to version 5.32.0 or newer (as per linked adv...

CVE-2021-44686

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS Regular Expression Denial of Service in htmlpreprocessrules in ebooks/conversion/preprocess.py...

PT-2021-24154 · Calibre · Calibre

Name of the Vulnerable Software and Affected Versions: calibre versions prior to 5.32.0 Description: The issue is related to a regular expression in html preprocess rules within the ebooks/conversion/preprocess.py file that is vulnerable to ReDoS Regular Expression Denial of Service. This could...

Calibre Cross-Site Request Forgery Vulnerability

Calibre is an open source free all-in-one eBook reading management and format conversion tool from Kovid Goyal, a personal developer in India. calibre web versions 0.6.0 through 0.6.13 are vulnerable to cross-site request forgery, which stems from the software's lack of check checksum for...

CVE-2021-25965

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery CSRF. By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application...

CVE-2021-25965

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery CSRF. By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application...

Cross site request forgery (csrf)

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery CSRF. By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application...

CVE-2021-25965 Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF)

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery CSRF. By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application...

CVE-2021-25965

Calibre-web (open-source web UI for Calibre) versions 0.6.0–0.6.13 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can lure an authenticated user to click a malicious link to create a new administrator-facing account and attacker-controlled credentials, enabling takeover of the a...

CVE-2021-25965 Calibre-web - Admin Account Takeover via Cross-Site Request Forgery (CSRF)

In Calibre-web, versions 0.6.0 to 0.6.13 are vulnerable to Cross-Site Request Forgery CSRF. By luring an authenticated user to click on a link, an attacker can create a new user role with admin privileges and attacker-controlled credentials, allowing them to take over the application...

PT-2021-16889 · Unknown · Calibre-Web

Name of the Vulnerable Software and Affected Versions: Calibre-web versions 0.6.0 through 0.6.13 Description: The issue allows an attacker to create a new user role with admin privileges and attacker-controlled credentials by luring an authenticated user to click on a link, potentially taking ove...

Calibre 跨站请求伪造漏洞

Calibre is an open source free all-in-one eBook reading management and format conversion tool from Kovid Goyal, a personal developer in India. calibre web versions 0.6.0 through 0.6.13 are vulnerable to cross-site request forgery, which stems from the software's lack of check checksum for...

Cross-site Scripting (XSS) - DOM in janeczku/calibre-web

Description It is possible to execute XSS payloads when editing book properties, such as uploading a cover or a format. Proof of Concept The file editbooks.js contains the following code: $"btn-upload-cover".on"change", function var filename = $this.val; if filename.substring3, 11 === "fakepath"...

CVE-2011-4126

Race condition issues were found in Calibre at devices/linuxmounthelper.c allowing unprivileged users the ability to mount any device to anywhere...

CVE-2011-4126

Race condition issues were found in Calibre at devices/linuxmounthelper.c allowing unprivileged users the ability to mount any device to anywhere...

DEBIAN-CVE-2011-4126

Race condition issues were found in Calibre at devices/linuxmounthelper.c allowing unprivileged users the ability to mount any device to anywhere...

CVE-2011-4125

A untrusted search path issue was found in Calibre at devices/linuxmounthelper.c leading to the ability of unprivileged users to execute any program as root...

CVE-2011-4125

A untrusted search path issue was found in Calibre at devices/linuxmounthelper.c leading to the ability of unprivileged users to execute any program as root...