Cross-Site Request Forgery (CSRF) in janeczku/calibre-web

Description Hi team :, the /shelf/remove/id and /shelf/add/id is vulnerable against CSRFleading to the possibility to add and remove shelves' items on the behalf of the victim user. Proof of Concept 1. Install the application 2. Create a new shelf id == 1 in this case 3. The attacker sends the...

Cross-site Scripting (XSS) - Stored in janeczku/calibre-web

💥 BUG stored xss via book description 💥 STEP TO REPRODUCE Lets there is two user Admin and user-B . user-B has edit permission in book.\ \ 1. Now goto user-B account and visit http://localhost:8083/admin/book/12 and edit the metadata .\ During edit put bellow xss payload in book Description field...

Cross-Site Request Forgery (CSRF) in janeczku/calibre-web

✍️ Description An attacker can make a user change his profile settings by CSRF vulnerability through PoC file. There is no CSRF token. 🕵️‍♂️ Proof of Concept For example, changing the email address from "[email protected]" to "[email protected]" test1's profile. Make the user open a link with this page...

Calibre-Web Authorization Issues Vulnerability

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. An authorization issue vulnerability exists in Calibre-Web version 0.6.6, which stems from the program's use of a hard-coded secret key that can be exploited by an attacker to bypass...

CVE-2020-12627

Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...

CVE-2020-12627

Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...

Hardcoded credentials

Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...

CVE-2020-12627

CVE-2020-12627 affects Calibre-Web 0.6.6 (Calibre-Web) and is caused by a hardcoded secret key ('A0Zr98j/3yX R~XHH!jmN]LWX/,?RT'), enabling authentication bypass. The Red Hat, CNVD, OSV, NVD, and CVE records consistently identify the same issue and impact. Documented impact is authentication bypa...

CVE-2020-12627

Calibre-Web 0.6.6 allows authentication bypass because of the 'A0Zr98j/3yX RXHH!jmNLWX/,?RT' hardcoded secret key...

PT-2020-13173 · Calibre · Calibre-Web

Name of the Vulnerable Software and Affected Versions: Calibre-Web version 0.6.6 Description: The issue allows authentication bypass due to a hardcoded secret key 'A0Zr98j/3yX RXHH!jmNLWX/,?RT'. Recommendations: For Calibre-Web version 0.6.6, update the secret key to a unique and secure value to...

Fedora 28 : calibre (2018-af8b2c28fe)

Update to calibure 3.19.0. See changelog at: https://calibre-ebook.com/whats-new Fixes CVE-2018-7889 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much ...

Updated calibre packages fix security vulnerability

Updated calibre package fixes security vulnerability: gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...

MGASA-2018-0399 Updated calibre packages fix security vulnerability

Updated calibre package fixes security vulnerability: gui2/viewer/bookmarkmanager.py in Calibre 3.18 calls cPickle.load on imported bookmark data, which allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call...

Fedora Update for calibre FEDORA-2018-6143b1d911

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 26 : calibre (2018-6143b1d911)

Update to calibure 3.19.0. See changelog at: https://calibre-ebook.com/whats-new Fixes CVE-2018-7889 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much ...

[SECURITY] Fedora 26 Update: calibre-3.19.0-1.fc26

Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the...

Fedora 27 : calibre (2018-5649824f49)

Update to calibure 3.19.0. See changelog at: https://calibre-ebook.com/whats-new Fixes CVE-2018-7889 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much ...

Fedora Update for calibre FEDORA-2018-5649824f49

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 27 Update: calibre-3.19.0-1.fc27

Calibre is meant to be a complete e-library solution. It includes library management, format conversion, news feeds to ebook conversion as well as e-book reader sync features. Calibre is primarily a ebook cataloging program. It manages your ebook collection for you. It is designed around the...

[ASA-201803-8] calibre: arbitrary command execution

Arch Linux Security Advisory ASA-201803-8 ========================================= Severity: High Date : 2018-03-11 CVE-ID : CVE-2018-7889 Package : calibre Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-650 Summary ======= The package calibre before...