2202 matches found
GHSA-5V5Q-3M7M-97J7 Image Resizer Cross-Site Request Forgery (CSRF)
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...
Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...
Image Resizer Cross-Site Request Forgery (CSRF)
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...
cfsshtunnel (>=0.1.7 <=0.2.1), click-reviewers-tools (>=0.70.0 <=0.84.0) +2 more potentially affected by CVE-2019-15795 via python-apt (=0.7.8)
python-apt PYPI version =0.7.8 is affected by a known vulnerability. The following packages have a transitive dependency on python-apt and may be impacted: - cfsshtunnel =0.1.7, =0.70.0, =0.84.0 - craft-parts =1.19.8 - plex-updater =0.1.0 Source cves: CVE-2019-15795 Source advisory:...
cfsshtunnel (>=0.1.7 <=0.2.1), click-reviewers-tools (>=0.70.0 <=0.84.0) +2 more potentially affected by CVE-2019-15796 via python-apt (=0.7.8)
python-apt PYPI version =0.7.8 is affected by a known vulnerability. The following packages have a transitive dependency on python-apt and may be impacted: - cfsshtunnel =0.1.7, =0.70.0, =0.84.0 - craft-parts =1.19.8 - plex-updater =0.1.0 Source cves: CVE-2019-15796 Source advisory:...
GHSA-WVR4-W6CW-4PX8 Craft CMS possibility of brute force attempts
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
Craft CMS possibility of brute force attempts
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
GHSA-F3XR-Q258-H7M9 Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
GHSA-W5Q4-Q7WP-QWW6 Craft CMS XSS Vulnerability
Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...
Craft CMS XSS Vulnerability
Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...
Security update for libxls (moderate)
openSUSE Security Update: Security update for libxls Announcement ID: openSUSE-SU-2022:0142-1 Rating: moderate References: 1192323 Cross-References: CVE-2021-27836 Affected Products: openSUSE Backports SLE-15-SP3 An update that fixes one vulnerability is now available. Description: This update fo...
CVE-2022-30065
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function...
GHSA-XV5F-2997-QHRQ Craft CMS XSS Vulnerability
Craft CMS before 2.6.2974 allows XSS attacks...
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2974 allows XSS attacks...
GHSA-9MCW-MWXV-GRWJ Craft CMS XSS Vulnerability
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
GHSA-J27G-R58Q-624W Craft CMS subject to URL forgery
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
Craft CMS subject to URL forgery
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...