GHSA-JHHF-C849-3RH2 Comments plugin stored Cross-site Scripting via a guest name

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via a guest name...

Comments plugin stored Cross-site Scripting via a guest name

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via a guest name...

GHSA-M69R-4H68-XQ7J Knock Knock plugin Open redirection vulnerability

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...

Knock Knock plugin Open redirection vulnerability

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...

Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...

GHSA-WXVR-QQM7-6H65 Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...

GHSA-5V5Q-3M7M-97J7 Image Resizer Cross-Site Request Forgery (CSRF)

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

GHSA-P7RM-GH9G-5FR8 Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

Image Resizer Cross-Site Request Forgery (CSRF)

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

GHSA-WVR4-W6CW-4PX8 Craft CMS possibility of brute force attempts

In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

Craft CMS possibility of brute force attempts

In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...

GHSA-F3XR-Q258-H7M9 Craft CMS XSS Vulnerability

Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...

Craft CMS XSS Vulnerability

Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...

GHSA-W5Q4-Q7WP-QWW6 Craft CMS XSS Vulnerability

Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...

Craft CMS XSS Vulnerability

Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...

Craft CMS XSS Vulnerability

Craft CMS before 2.6.2974 allows XSS attacks...

GHSA-XV5F-2997-QHRQ Craft CMS XSS Vulnerability

Craft CMS before 2.6.2974 allows XSS attacks...

Craft CMS subject to URL forgery

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

GHSA-9MCW-MWXV-GRWJ Craft CMS XSS Vulnerability

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...