CVE-2023-33495

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

CVE-2023-33495

CVE-2023-33495 affects Craft CMS up to version 4.4.9, where an HTML Injection vulnerability exists in the CMS (the exact root cause is described only as HTML Injection in the sources). Impact is described as enabling injection of HTML content, with a CVSS v3.1 base score of 6.1 (Medium). The avai...

CVE-2023-33495

Craft CMS through 4.4.9 is vulnerable to HTML Injection...

CVE-2023-1183

A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker...

craft-web.co.jp Cross Site Scripting vulnerability OBB-3442177

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

craft-web.co.jp Cross Site Scripting vulnerability OBB-3437853

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

craft-web.co.jp Cross Site Scripting vulnerability OBB-3425615

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

UFO Whistleblower, Meet a Conspiracy-Loving Congress

Fresh claims from a former US intelligence officer about an “intact” alien craft may get traction on Capitol Hill, where some lawmakers want to believe...

The signature "V" length is not checked in castApprovalBySig, CastDisapprovalBySig & createActionBySig

Lines of code Vulnerability details Impact The length of the "v" value in the signatures is not checked. V must correspond according to ECDSA principles values of either 27 or 28. Not checking this will result in an attacker crafting a malicious v value and bypassing any checks, withdrawing funds...

PT-2023-22567 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: CraftCMS version 3.7.59 Description: The issue concerns Server-Side Template Injection SSTI, where an authenticated attacker can inject Twig Template into the User Photo Location field in User Settings, potentially leading to Remote Code...

craft-web.co.jp Cross Site Scripting vulnerability OBB-3419711

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

VaultProxy can be selfdestructed using delegatecall

Lines of code Vulnerability details Impact Attacker can selfdestruct VaultProxy deployment. constructor //initialise the vault proxy with data function initialise bool isValidatorWithdrawalVault, uint8 poolId, uint256 id, address staderConfig external if isInitialized revert AlreadyInitialized;...

Huawei EulerOS: Security Advisory for libtiff (EulerOS-SA-2023-2126)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

craft-web.co.jp Cross Site Scripting vulnerability OBB-3393795

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Remote Code Execution (RCE)

craftcms/cms is vulnerable to Remote Code Execution RCE. The vulnerability exists due to a lack of file extension validation in the resolveTemplate function when the name parameter is empty, which allows an admin authenticated attacker to upload and execute malicious code on the system...

Cross site scripting

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195

CVE-2023-33195 affects Craft CMS prior to 4.4.6, where a malformed RSS feed in the RSS widget could deliver a Cross‑Site Scripting (XSS) payload via the feed, enabling script execution. The issue is addressed by upgrading to Craft CMS 4.4.6 or later (patch referenced in the project release notes ...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...