440 matches found
CVE-2020-11094
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as...
CVE-2020-11094
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as...
Design/Logic Flaw
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as...
October CMS Command Injection Vulnerability
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A command injection vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. The vulnerability stems from a network system or product not proper...
October CMS Directory Traversal Vulnerability
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. An attacker can exploit the vulnerability to upload files to any directory o...
October CMS debugbar plugin log message disclosure vulnerability
October CMS is a PHP and Laravel Web application framework based on open source content management system CMS. debugbar plugin is used in which an application debugging bar plugin . A log information disclosure vulnerability exists in the October CMS debugbar plugin prior to version 3.1.0, which ...
October CMS Arbitrary File Read Vulnerability (CNVD-2020-38885)
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. An attacker could exploit the vulnerability to read local files on the Octob...
October CMS Arbitrary File Read Vulnerability
October CMS is an open source content management system CMS based on PHP and Laravel web application framework. A security vulnerability exists in October CMS composer versions 1.0.319 and later fixed in version 1.0.466. An attacker could exploit the vulnerability to delete arbitrary local files...
CVE-2020-11094
CVE-2020-11094 affects the October CMS debugbar plugin prior to v3.1.0. The issue is an information disclosure vulnerability where the plugin logs all requests, including session data, which could allow untrusted users to view sensitive information. Affected component is the debugbar feature that...
CVE-2020-11094 Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar
The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as...
GHSA-C8WH-6JW4-2H79 Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar
Impact The debugbar contains a perhaps little known feature where it will log all requests and all information pertaining to each request including session data whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potenti...
October CMS - Upload Protection Bypass Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'October CMS Upload Protection Bypass Code Execution', 'Description' = %q This module exploits an Authenticated user with permission to upload and...
October CMS Upload Protection Bypass Code Execution Exploit
This Metasploit module exploits an Authenticated user with permission to upload and manage media contents can upload various files on the server. Application prevents the user from uploading PHP code by checking the file extension. It uses black-list based approach, as seen in...
October CMS Upload Protection Bypass Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'October CMS Upload Protection Bypass Code Execution', 'Description' = %q This module exploits an Authenticated user with permission to upload and...
Local File Inclusion
October CMS is vulnerable to local file inclusion. The function validatePath in modules/system/classes/MediaLibrary.php does not perform validation of file paths. This allows an attacker to manipulate the folder names with ../ characters through the request headers to retrieve confidential system...
October CMS Local File Inclusion Vulnerability
October CMS is an open source, self-hosted content management system CMS built on the Laravel PHP framework developed by Canadian software developer Alexey Bobkov and Australian software developer Samuel Georges. A local file inclusion vulnerability exists in the modules/system/traits/ViewMaker.p...
Cross site scripting
October CMS version prior to build 437 contains a Cross Site Scripting XSS vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable...
CVE-2018-1999009
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php244 makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend pat...
CVE-2018-1999008
October CMS version prior to build 437 contains a Cross Site Scripting XSS vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable...
CVE-2018-1999009
October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php244 makeFileContents function that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend pat...