roncq-automobiles.com Cross Site Scripting vulnerability OBB-2153515

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2021-41456

creationtimestamp| type| source ---|---|--- 2021-10-01 16:15:06+00:00| seen| https://t.me/cibsecurity/29793...

medialead.de Cross Site Scripting vulnerability OBB-2153224

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

KLA12331 Multiple vulnerabilities in Oracle Java SE

Multiple vulnerabilities were found in Oracle Java SE. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, cause denial of service, gain privileges, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Security...

The vulnerability of the CMS system October CMS, related to the lack of a password recovery mechanism, allows attackers to gain access to any user account at will.

The vulnerability of the CMS system October CMS is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker to gain access to any account by using a specially created request...

October CMS auth bypass and account takeover

Impact An attacker can exploit this vulnerability to bypass authentication using a specially crafted persist cookie. - To exploit this vulnerability, an attacker must obtain a Laravel’s secret key for cookie encryption and signing. - Due to the logic of how this mechanism works, a targeted user...

GHSA-MXR5-MC97-63RC Account Takeover in Octobercms

Impact An attacker can request an account password reset and then gain access to the account using a specially crafted request. - To exploit this vulnerability, an attacker must know the username of an administrator and have access to the password reset form. Patches - Issue has been patched in...

Octobercms 安全漏洞

Octobercms is a Php-based Cms website builder from the US company Octobercms. A security vulnerability exists in octobercms october, which originates in an affected version of the october/system package, where an attacker can request a reset of an account password and then use a specially crafted...

October CMS 安全漏洞

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. October CMS has a security vulnerability that can be exploited by an attacker to bypass authentication and user account takeover on the server via a crafted request. An attacker mus...

PT-2021-4044

Name of the Vulnerable Software and Affected Versions: October CMS versions prior to Build 472 and v1.1.5 Description: The issue is related to an improper authentication mechanism in the October CMS platform, which is based on the Laravel PHP Framework. An attacker can exploit this by requesting ...

PT-2021-18249 · October · October/System

Name of the Vulnerable Software and Affected Versions: october/system package versions prior to v1.1.5 october/system package versions prior to Build 472 Description: The issue allows an attacker to bypass authentication and take over a user account on an October CMS server. This can be exploited...

GHSA-GHPQ-VJXW-CH5W Use after free in libpulse-binding

Overview Version 1.2.1 of the libpulse-binding Rust crate, released on the 15th of June 2018, fixed a pair of use-after-free issues with the objects returned by the getformatinfo and getcontext methods of Stream objects. These objects were mistakenly being constructed without setting an important...

Fake Windows 11 installers infecting devices with adware, malware

By Deeba Ahmed Originally, Windows 11 will be available for download from October 2021 - It will be a free upgrade for existing Windows 10 users. This is a post from HackRead.com Read the original post: Fake Windows 11 installers infecting devices with adware, malware...

Lenovo K5 Pro phone has information leakage vulnerability

The Lenovo K5pro phone is an extremely low-priced mass model released in mid-October 2018 by Lenovo. The Lenovo K5 Pro phone has an information disclosure vulnerability that can be exploited by attackers to gain access to sensitive information...

Sandbox Escape

October is vulnerable to sandbox escape. An authenticated backend user with cms.managepages, cms.managelayouts, or cms.managepartials permissions is allowed to write malicious Twig code leading to an escape from sandbox even if cms.enableSafeMode is set. This vulnerability is a bypass of the fix...

CVE-2021-21264

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the cms.managepages,...

CVE-2021-21264

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the cms.managepages,...

Design/Logic Flaw

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the cms.managepages,...

CVE-2021-21264 Bypass of fix for CVE-2020-26231, Twig sandbox escape

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the cms.managepages,...

CVE-2021-21264

CVE-2021-21264 affects October CMS (Laravel-based) and describes a Twig sandbox bypass where an authenticated backend user with cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions can write PHP code despite cms.enableSafeMode being enabled. The vulnerability mirrors the impac...