Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from the US company Pixel & tonic. A cross-site scripting vulnerability exists in Craft CMS versions 3.0.0 through 3.8.3 and 4.0.0 through 4.4.3, which stems from a formatting error in the malformed title that can deliver XSS loads...

CVE-2023-27929

An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13.3, tvOS 16.4, iOS 16.4 and iPadOS 16.4, watchOS 9.4. Processing a maliciously crafted image may result in disclosure of process memory...

New Vulnerability in Popular WordPress Plugin Exposes Over 2 Million Sites to Cyberattacks

Users of Advanced Custom Fields plugin for WordPress are being urged to update version 6.1.6 following the discovery of a security flaw. The issue, assigned the identifier CVE-2023-30777, relates to a case of reflected cross-site scripting XSS that could be abused to inject arbitrary executable...

PT-2023-23177 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: Craft CMS versions 3.0.0 through 3.8.3 Craft CMS versions 3.8.4 is not affected for version 3, but versions prior to 4.4.4 are affected for version 4, so Craft CMS versions 4.0.0 through 4.4.3 Description: A malformed title in the feed widget...

PT-2023-22566 · Craft Cms · Craft Cms

Name of the Vulnerable Software and Affected Versions: CraftCMS versions 3.7.59 through 3.7.67 Description: The issue allows an attacker to inject javascript code into the Volume Name, potentially leading to Cross Site Scripting XSS attacks. This could enable attackers to execute malicious script...

CVE-2023-29478

BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on the filesystem. This includes the Minecraft mods folder, which results in code execution...

CVE-2023-24295

A stack overfow in SoftMaker Software GmbH FlexiPDF v3.0.3.0 allows attackers to execute arbitrary code after opening a crafted PDF file...

Craft CMS Stored Cross-site Scripting Injection Vulnerability

Summary When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact Tested with the free version of Craft...

GHSA-QCRJ-6FFC-V7HQ Craft CMS Stored Cross-site Scripting Injection Vulnerability

Summary When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the admin dashboard. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact Tested with the free version of Craft...

CVE-2023-23927

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...

Cross site scripting

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...

CVE-2023-23927

Craft CMS is vulnerable to a stored XSS in the quick post widget on the admin dashboard when a payload is inserted into a label name or an entry type instruction. The issue affects Craft CMS prior to version 4.3.7 and has been fixed in 4.3.7. The CVE entry is supported by multiple connected sourc...

CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...

CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...

CVE-2023-23927 Craft CMS stored cross-site scripting vulnerability

Craft is a platform for creating digital experiences. When you insert a payload inside a label name or instruction of an entry type, an cross-site scripting XSS happens in the quick post widget on the admin dashboard. This issue has been fixed in version 4.3.7...

Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, USA. A cross-site scripting vulnerability exists in Craft CMS versions prior to 4.3.7, which stems from a cross-site scripting XSS vulnerability...

SUSE CVE-2014-0134

The instance rescue mode in OpenStack Compute Nova 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and usecowimages is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image...

SUSE CVE-2016-4354

ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service crash via crafted BER data, which leads to a buffer overflow...

SUSE CVE-2016-4355

Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to cause a denial of service crash via crafted BER data, which leads to a buffer overflow...

SUSE CVE-2017-11526

The ReadOneMNGImage function in coders/png.c in ImageMagick before 6.9.9-0 and 7.x before 7.0.6-1 allows remote attackers to cause a denial of service large loop and CPU consumption via a crafted file...