876 matches found
CVE-2021-43996
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control...
Improper access control
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control...
CVE-2021-43996
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control...
CVE-2021-43996
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control...
CVE-2021-43996
CVE-2021-43996 concerns the Laravel Ignition component. The issue is that the built-in “fix variable names” feature in Ignition prior to version 1.16.15, and in the 2.0.x branch prior to 2.0.6, can lead to incorrect access control. Affected versions are: Laravel Ignition before 1.16.15, and 2.0.x...
PT-2021-23998 · Laravel · Laravel Ignition
Name of the Vulnerable Software and Affected Versions: Laravel Ignition component versions prior to 1.16.15 Laravel Ignition component versions 2.0.x prior to 2.0.6 Description: The issue concerns the "fix variable names" feature in the Ignition component for Laravel, which can lead to incorrect...
Facade Ignition for Laravel 安全漏洞
Facade Ignition for Laravel is a customizable error page from Facade Belgium that runs in the Laravel web framework. A security vulnerability exists in Facade Ignition for Laravel, which stems from the product's fix variable names feature that does not add effective access control...
CVE-2021-43996: Undefined Security Weakness
The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control...
Ignition PHP Framework Code Execution
The vulnerability of the filegetcontents and fileputContents methods in the Ignition PHP framework’s Laravel library is related to improper code generation. Exploiting this vulnerability may allow an attacker to execute arbitrary code...
coreos-installer < 0.10.0 writes world-readable Ignition config to installed system
Impact On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to /boot/ignition/config.ign with world-readable permissions, granting unprivileged users access to any secrets included in the config. Default configurations of Fedora CoreOS and RHEL...
GHSA-862G-9H5M-M3QV coreos-installer < 0.10.0 writes world-readable Ignition config to installed system
Impact On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to /boot/ignition/config.ign with world-readable permissions, granting unprivileged users access to any secrets included in the config. Default configurations of Fedora CoreOS and RHEL...
PT-2021-22427 · Unknown · Coreos-Installer
Name of the Vulnerable Software and Affected Versions: coreos-installer versions prior to 0.10.0 Description: A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read...
coreos-installer: restrict access permissions on /boot/ignition{,/config.ign}
A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality...
Critical severity vulnerability in Ignition
The Ignition page before version 2.0.5 for Laravel mishandles globals, get, post, cookie, and env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix...
GHSA-M5V7-PR32-MJX2 Critical severity vulnerability in Ignition
The Ignition page before version 2.0.5 for Laravel mishandles globals, get, post, cookie, and env. NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix...
Exploit for CVE-2021-3129
laravel-CVE-2021-3129-EXP CVE-2021-3129: One-click g...
Wordpress plugin Controlled Admin Access 访问控制错误漏洞
WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in multiple Wordpress plugins that allows an attacker to use this endpoint to add arbitrary data to predefined options in the wpoptions table. The following products and versions are affected: The...
Ignition 2.5.1 Remote Code Execution Exploit
Ignition versions prior to 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel versions prior to 8.4.2. Exploit...
Ignition 2.5.1 Remote Code Execution
Exploit Title: Laravel debug mode Remote Code Execution Ignition = 2.5.1 Date: 05/04/2021 Exploit Author: Tobias Marcotto Tested on: Kali Linux x64 Version: 2.5.1 Description: Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrar...
GHSA-4QWP-7C67-JMCC Unauthenticated remote code execution in Ignition
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of filegetcontents and fileputcontents. This is exploitable on sites using debug mode with Laravel before 8.4.2...