428 matches found
User Plugin for October CSS Allows XSS
An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...
GHSA-X5JC-34XF-C24Q User Plugin for October CSS Allows XSS
An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...
GHSA-VM6R-4P4V-232X October CMS CSRF
Cross-Site Request Forgery exists in OctoberCMS 1.0.426 aka Build 426 due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a...
GHSA-Q263-J3Q9-G964 October CMS PHP Code Execution
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server...
October CMS PHP Code Execution
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server...
GHSA-8VH6-8W76-V6M3 October CMS File Upload Vulnerability
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
GHSA-3P6C-9XHM-8X7H October CMS XSS
October CMS build 412 is vulnerable to stored XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...
October CMS XSS
October CMS build 412 is vulnerable to stored XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...
GHSA-96MH-7XPR-QCGW October CMS - RainLab Blog Plugin XSS
The RainLab Blog Plugin used in October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...
October CMS - RainLab Blog Plugin XSS
The RainLab Blog Plugin used in October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...
October CMS Local File Inclusion
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path i...
GHSA-V7CR-W5V6-6659 October CMS Local File Inclusion
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path i...
October CMS File Upload Vulnerability
October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server...
The vulnerability of the CMS system October CMS, related to improper verification of the cryptographic signature, allows a hacker to gain unauthorized access to protected information.
The vulnerability of the CMS system October CMS is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Remote Code Execution (RCE)
October CMS is vulnerable to Remote Code Execution RCE. The vulnerability exists because the library does not properly sanitize the user input before rendering, allowing an attacker who has access to the backend to manipulate web pages via cms.safemode or cms.enableSafeMode to execute arbitrary...
Authenticated remote code execution in October CMS
Impact An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode / cms.enableSafeMode in order to execute arbitrary code. - This issue only affects admin panels that rely on safe mode and restricted permissions. - T...
October CMS Authentication Bypass (CVE-2021-32648)
An authentication bypass vulnerability exists in October CMS. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...
Ukraine: Recent Cyber Attacks Part of Wider Plot to Sabotage Critical Infrastructure
The coordinated cyberattacks targeting Ukrainian government websites and the deployment of a data-wiper malware called WhisperGate on select government systems are part of a broader wave of malicious activities aimed at sabotaging critical infrastructure in the country. The Secret Service of...
October CMS Improper Authentication
In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request...
Ukraine government entities targeted by a destructive malware “Whispergate”
THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. A malware attack was carried out on Ukraine government, non-profit, and IT entities with a wiper disguised as ransomware. The threat actor, DEV-0586 targeted government bodies that provide critical executive branch or emergen...