2859 matches found
CVE-2020-13868
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...
Cross site scripting
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name...
Cross site request forgery (csrf)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...
Cross site scripting
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...
CVE-2020-13868
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...
CVE-2020-13868
The CVE-2020-13868 entry affects the Craft CMS Comments plugin prior to version 1.5.5, with a CSRF flaw that can compromise the integrity of comments. The connected sources confirm the vulnerability and link to a changelog entry noting the fixed version (1.5.5, dated 2020-05-28). No exploitation ...
CVE-2020-13869
The CVE-2020-13869 issue affects the Craft CMS Comments plugin prior to version 1.5.6. It enables stored XSS via the guest name field, due to insufficient input sanitization (as corroborated by multiple sources). Impact: attacker-supplied guest name can inject scripts and run in a user’s browser....
CVE-2020-13869
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name...
CVE-2020-13870
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...
CVE-2020-13870
CVE-2020-13870 affects the Craft CMS Comments plugin prior to 1.5.5, with a stored XSS flaw via an asset volume name. Root cause: lack of input validation leading to stored XSS. Impact is dependent on affected Craft CMS deployments; remediation is to upgrade the Comments plugin to 1.5.5 or later....
CVE-2020-13868: Cross-Site Request Forgery (CSRF)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...
CVE-2020-13870: Improper Neutralization of Input During Web Page Generation
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...
CVE-2020-13869: Improper Neutralization of Input During Web Page Generation
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name...
Shopify: Ability to generate shipping labels in another store orders
Details A shop owner creating a session on its own store on https://mailbox.shopifycloud.com/ service can craft request to print labels on another store he doesn't have access to. Steps to reproduce 1. Go to an unfulfilled order and click on Create a shipping label 2. Copy the CURL request that i...
Image Resizer Cross-Site Request Forgery Vulnerability
Pixel & Tonic Craft CMS is a content management system CMS of Pixel & Tonic, Inc. Image Resizer is one of the image editing plug-ins. A cross-site request forgery vulnerability exists in Image Resizer versions prior to 2.0.9 for Pixel & Tonic Craft CMS. A remote attacker could exploit this...
Knock Knock Security Restriction Bypass Vulnerability
Pixel & Tonic Craft CMS is the United States Pixel & Tonic company's set of content management system CMS.Knock Knock is one of the access rights management plugin. A security vulnerability exists in Knock Knock versions prior to 1.2.8 for Pixel & Tonic Craft CMS. The vulnerability can be exploit...
Knock Knock Input Validation Error Vulnerability
Pixel & Tonic Craft CMS is the United States Pixel & Tonic company's set of content management system CMS.Knock Knock is one of the access rights management plugin. A security vulnerability exists in Knock Knock versions prior to 1.2.8 for Pixel & Tonic Craft CMS. An attacker can exploit this...
Image Resizer Cross-Site Scripting Vulnerability
Pixel & Tonic Craft CMS is a content management system CMS of Pixel & Tonic, Inc. Image Resizer is one of the image editing plug-ins. A cross-site scripting vulnerability exists in Image Resizer versions prior to 2.0.9 for Pixel & Tonic Craft CMS. The vulnerability stems from a lack of proper...
