481 matches found
GHSA-XQ58-69H2-765M Cross Site Request Forgery in mailman
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...
CVE-2021-44227
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...
CVE-2021-44227
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...
CVE-2021-44227: Cross-Site Request Forgery (CSRF)
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...
Security fix for the ALT Linux 9 package mailman version 5:2.1.36-alt1
Nov. 13, 2021 Konstantin Lepikhov 5:2.1.36-alt1 - Updated to 2.1.36. - Security fixes: + CVE-2021-43331: A potential XSS attack via the user options. + CVE-2021-43332: A potential for for a list moderator to carry out an off-line brute force attack to obtain the list admin password...
mailman -- 2.1.37 fixes XSS via user options, and moderator offline brute-force vuln against list admin password
Mark Sapiro reports: A potential XSS attack via the user options page has been reported by Harsh Jaiswal. This is fixed. CVE-2021-43331 LP: 1949401. A potential for for a list moderator to carry out an off-line brute force attack to obtain the list admin password has been reported by Andre Protas...
CVE-2021-32924
Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...
CVE-2021-32924
Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...
Code injection
Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...
CVE-2021-32924: Improper Control of Generation of Code
Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...
AM Live Vulnerability Management Conference Part 1: Full video in Russian + Timecodes in English
Hello all! 2 weeks ago I participated in the best online event fully dedicated to Vulnerability Management in Russia. It was super fun and exciting. Thanks to all the colleagues and especially to Lev Paley for the great moderation! I have talked out completely. Everything I wanted and the way I...
CVE-2021-27949
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...
CVE-2021-27949
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...
Cross site scripting
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...
CVE-2021-27949
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...
CVE-2021-27949
CVE-2021-27949: MyBB prior to 1.8.26 is vulnerable to Cross-site Scripting via the Custom moderator tools. The issue affects the MyBB web forum software (PHP/MySQL) and is triggered through inputs handled by moderator tools, enabling injected scripts to run in a victim’s browser. The recommended ...
CVE-2021-27949
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...
CVE-2021-27949
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools...
MyBB cross-site scripting vulnerability
MyBB MyBulletinBoard is a free and web-based forum software developed by MyBB MYBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB before 1.8.26, which stems from a cross-site...