425 matches found
October CMS PHP Code Execution
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server...
GHSA-Q263-J3Q9-G964 October CMS PHP Code Execution
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server...
GHSA-3P6C-9XHM-8X7H October CMS XSS
October CMS build 412 is vulnerable to stored XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...
GHSA-96MH-7XPR-QCGW October CMS - RainLab Blog Plugin XSS
The RainLab Blog Plugin used in October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...
October CMS Local File Inclusion
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path i...
October CMS File Upload Vulnerability
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
October CMS XSS
October CMS build 412 is vulnerable to stored XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...
October CMS - RainLab Blog Plugin XSS
The RainLab Blog Plugin used in October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...
GHSA-V7CR-W5V6-6659 October CMS Local File Inclusion
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path i...
GHSA-8VH6-8W76-V6M3 October CMS File Upload Vulnerability
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
The vulnerability of the CMS system October CMS, related to improper verification of the cryptographic signature, allows a hacker to gain unauthorized access to protected information.
The vulnerability of the CMS system October CMS is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Remote Code Execution (RCE)
October CMS is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library does not properly sanitize the user input before rendering, allowing an attacker who has access to the backend to manipulate web pages via cms.safemode or cms.enableSafeMode to execute arbitrary...
Authenticated remote code execution in October CMS
Impact An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode / cms.enableSafeMode in order to execute arbitrary code. - This issue only affects admin panels that rely on safe mode and restricted permissions. - T...
October CMS Authentication Bypass (CVE-2021-32648)
An authentication bypass vulnerability exists in October CMS. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...
Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure
The coordinated cyberattacks targeting Ukrainian government websites and the deployment of a data-wiper malware called WhisperGate on select government systems are part of a broader wave of malicious activities aimed at sabotaging critical infrastructure in the country. The Secret Service of...
October CMS Improper Authentication
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request...
Ukraine government entities targeted by a destructive malware “Whispergate”
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. A malware attack was carried out on Ukraine government, non-profit, and IT entities with a wiper disguised as ransomware. The threat actor, DEV-0586 targeted government bodies that provide critical executive branch or emergen...
Remote Code Execution (RCE)
October CMS is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the input via the theme import function allowing an attacker with access to the backend to execute maliciously crafted PHP code...
Remote Code Execution (RCE)
October CMS is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of PHP code int he template markup allowing an attacker with "create, modify and delete website pages" privileges to inject maliciously crafted PHP code...
October CMS Code Injection Vulnerability
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. October CMS suffers from a code injection vulnerability that arises from a failure of a network system or product to properly filter specific elements of externally entered data during...