605 matches found
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date...
Code injection
Contao 4.7 allows Use of a Key Past its Expiration Date...
Default credentials
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
CVE-2019-10642
Contao 4.7 allows CSRF...
CVE-2019-10642
Contao 4.7 allows CSRF...
CVE-2018-20028
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
CVE-2018-20028
The CVE-2018-20028 vulnerability affects Contao: 3.x before 3.5.37, 4.4.x before 4.4.31, and 4.6.x before 4.6.11 suffer from Incorrect Access Control that enables viewing records not authorized for the logged-in back end user. The issue allows unauthorized users to view records (e.g., pages, arti...
CVE-2018-20028
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
CVE-2019-10642
Contao 4.7 allows CSRF...
CVE-2019-10642
Contao 4.7 is affected by a CSRF token check bypass (CSRF vulnerability). Multiple connected advisories (GHSA-HWMH-9JJ9-8C9C, OSV/GHSA-...) describe that the request token verification can be bypassed, enabling unauthorized actions within Contao 4.7. The CVE entry CVE-2019-10642 explicitly states...
CVE-2019-10643
CVE-2019-10643 affects Contao 4.7 where an opt-in token can be misused because old opt-in tokens are not invalidated when a new token is confirmed. The root cause is token lifecycle not expiring prior tokens; this is described across multiple connected advisories (GHSA-j99G-QJVX-995G, Contao secu...
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date...
CVE-2019-10641
Contao contains a session invalidation flaw: existing user sessions are not properly invalidated when a password is changed. Affected versions include Contao 3.* up to 3.5.38 and Contao 4.x up to 4.7.2, with the fix released in Contao 3.5.39, 4.4.37, or 4.7.3. The issue, identified in CVE-2019-10...
CVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
CVE-2019-10641: Weak Password Recovery Mechanism for Forgotten Password
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
CVE-2019-10643: Improper Authentication
Contao 4.7 allows Use of a Key Past its Expiration Date...
CVE-2018-20028: Undefined Security Weakness
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
Cross-site Request Forgery (CSRF)
Contao is susceptible to cross-site request forgery attacks. The vulnerability exists as the server does not verify the authenticity of HTTP requests, allowing a remote attacker to perform unauthorized actions on behalf of the user by tricking a user into visiting a malicious site...
Incorrect Session Invalidation
Contao has done incorrect session invalidation. It does not perform correct session invalidation for existing sessions when users update their passwords in frontend or backend...