CVE-2023-34235 Leaking sensitive user information still possible by filtering on private with prefix fields

Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the tnumber prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to...

@antgineering-studio/strapi (4.5.5), @chargeover/strapi (0.0.1-rc1.1) +100 more potentially affected by CVE-2023-34235 via @strapi/utils (>=4.0.0, <=4.10.7)

@strapi/utils NPM version =4.0.0, =1.0.0, =1.3.0, =1.4.1 - @codeparticle/strapi-plugin-graphql 4.9.2 and more Source cves: CVE-2023-34235 Source advisory: OSV:GHSA-9XG4-3QFM-9W8F...

CVE-2023-34093

Strapi (open-source CMS) prior to version 4.10.8 is vulnerable to information disclosure due to improper handling of Content-Type attributes. The issue arises from the removal of the privateAttributes getter when users extend or modify content-types, which can cause any attribute to become public...

Insurance 跨站脚本漏洞

Insurance is a responsive business and insurance related web content management system CMS from the phpscriptpoint team. A cross-site scripting vulnerability exists in Insurance version 1.2, which stems from the inclusion of unknown functions in the file search.php, resulting in cross-site...

Insurance 跨站脚本漏洞

Insurance is a responsive business and insurance related web content management system CMS from the phpscriptpoint team. A cross-site scripting vulnerability exists in Insurance version 1.2, which stems from the inclusion of unknown functions in the file page.php, resulting in cross-site scriptin...

CVE-2023-36339

An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request...

CVE-2023-37742

WebBoss.io CMS before v3.7.0.1 was discovered to contain a reflected cross-site scripting XSS vulnerability...

Adrian indico 跨站脚本漏洞

Adrian indico is an application of Adrian open source . A hierarchical content management system. A cross-site scripting vulnerability exists in versions prior to Adrian indico 3.2.6, which stems from vulnerability to cross-site scripting attacks...

WebBoss.io 安全漏洞

WebBoss.io is a website building platform for professional designers and developers from WebBoss.io. A security vulnerability exists in WebBoss.io CMS version v3.7.0, which stems from an access control issue that allows an attacker to access the website backup tool via a crafted GET request...

Babel 缓冲区错误漏洞

Babel is a multilingual support module used in content management systems. A buffer error vulnerability exists in Open Babel version 3.1.1. An attacker could exploit this vulnerability to cause arbitrary code execution via a specially crafted, malformed file...

Babel 缓冲区错误漏洞

Babel is a multilingual support module used in content management systems. A buffer error vulnerability exists in Open Babel version 3.1.1. An attacker could exploit this vulnerability to cause arbitrary code execution via a specially crafted, malformed file...

CVE-2023-37164

Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the catid parameter at /shop/?module=shop&action=search...

Active IT zone Active Super Shop CMS 跨站脚本漏洞

Active It Zone Active IT zone Active Super Shop CMS is a Super Shop CMS from Active It Zone Inc. A cross-site scripting vulnerability exists in Active It Zone Active Super Shop CMS version 2.5, which stems from the parameter name/phone/address in the component Manage Details Page that can lead to...

Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in Oracle Java SE

Summary There is a vulnerability in Oracle Java SE used by Enterprise Content Management System Monitor. Enterprise Content Management System Monitor has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2023-21930 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle...

Joomla 跨站脚本漏洞

Joomla! is a set of forum components used in the Joomla! content management system. A security vulnerability exists in Joomla! that stems from a cross-site scripting vulnerability...

CVE-2023-37269

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...

Cross site scripting

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...

CVE-2023-37269

Winter CMS is vulnerable to a stored XSS due to unsanitized SVG uploads in the branding logo function prior to v1.2.3. The issue requires an attacker with backend.manage_branding permission (or higher) and user interaction by visiting the URL of the malicious SVG; exploitation is further constrai...

The vulnerability of Adobe Experience Manager’s content and media data management system, which stems from the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of Adobe Experience Manager’s content and media data management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CMS Made Simple 代码问题漏洞

CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A code issue vulnerability exists in CMS Made Simple v2.2.17,...