2202 matches found
CVE-2022-29933
Craft CMS up to version 3.7.36 is affected by a password-reset poisoning vulnerability. An unauthenticated attacker who knows a valid username can reset the target account by supplying a crafted HTTP header (X-Forwarded-Host) to the password-reset URL at /index.php?p=admin/actions/users/send-pass...
Craft CMS 3.7.36 Password Reset Poisoning Attack Vulnerability
Craft CMS version 3.7.36 suffers from a password reset poisoning vulnerability. An unauthenticated attacker who knows valid email addresses or account names of Craft CMS backend users is able to manipulate the password reset functionality in a way that the registered users of the CMS receive...
Pixel＆tonic Craft CMS 授权问题漏洞
Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, USA. A security vulnerability exists in Craft CMS version 3.7.36, which stems from the presence of a password reset poisoning vulnerability. An attacker could exploit this vulnerability to manipulate the password reset...
Craft CMS 3.7.36 Password Reset Poisoning Attack
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Password Reset Poisoning Attack product: Craft CMS vulnerable version: 3.7.36 and potentially lower fixed version: none, see workaround by vendor CVE number: CVE-2022-299...
Vulnerability of the Server component: The Replication function of the MySQL Server database management system, which allows attackers to trigger an emergency shutdown.
The vulnerability of the MySQL Server database management system’s replication component exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to trigger an emergency shutdown through network packets...
Craft fair vendors targeted by fake event scammers on Facebook
A real world scam which sucks the fun out of craft fairs has caused nothing but stress for victims. It may sound bizarre, but it’s actually a fairly popular attack focused on small/self-run business owners selling their own creations. Are you ready for a trip to the craft fair? You’re a small...
CVE-2021-44491
An issue was discovered in YottaDB through r1.32 and V7.0-000. Using crafted input, attackers can cause a calculation of the size of calls to memset in opfnj3 in srport/opfnj3.c to result in an extremely large value in order to cause a segmentation fault and crash the application. This is a digs-...
CVE-2022-27139
An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file. NOTE: Vendor states that as outlined in Ghost's security documentation, upload of SVGs is only possible by trusted authenticated users. The uploadin...
GHSA-WF98-VXV9-JQFV XSS Injection Vulnerability
Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md3729---2022-01-18 For more information If you hav...
XSS Injection Vulnerability
Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md3729---2022-01-18 For more information If you hav...
GHSA-7XJ5-FWQR-5378 Cross-site Scripting in craftcms/cms
Craft CMS before 3.7.29 allows cross-site scripting...
Cross-site Scripting in craftcms/cms
Craft CMS before 3.7.29 allows cross-site scripting...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
Cross site scripting
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS vulnerability (CVE-2022-28378) : The XSS flaw affects Craft CMS versions before 3.7.29. Public sources attribute the issue to the FeedWidget.js input handling, where unfiltered links enable script injection. Impact is cross-site scripting with user interaction sometimes required dependi...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
Pixel＆tonic Craft CMS 跨站脚本漏洞
Pixel & tonic Craft CMS is a content management system CMS from Pixel & Tonic Pixel & tonic USA. A security vulnerability exists in Craft CMS versions prior to 3.7.29 that allows an attacker to execute cross-site scripting...