4131 matches found
CVE-2020-15247 Twig Sandbox Escape by authenticated users with access to editing CMS templates when safemode is enabled.
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be...
CVE-2020-15247
Technical details about CVE-2020-15247 are not publicly provided in the connected documents. The available sources mention related CVEs and patches for October CMS, but no explicit technical specifics are included here. Monitor for updates.
CVE-2020-15246 Local File Inclusion by unauthenticated users
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.421 and before version 1.0.469, an attacker can read local files on an October CMS server via a specially crafted request. Issue has been patched in Build 469 v1.0.469 and...
CVE-2020-15246
CVE-2020-15246 affects October CMS (Laravel-based). A Local File Inclusion (LFI) vulnerability allows reading local files on an October CMS server via a specially crafted request. Affected versions are 1.0.421 up to, but not including, 1.0.469. The issue has been patched in Build 469 (v1.0.469) a...
October CMS Security Breach
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October 1.0.319 and versions prior to 1.0.470, which stems from an enabled enableSafeMode that allows specific Twig code to be written to escape t...
October CMS Cross-Site Scripting Vulnerability
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October CMS versions 1.0.319 and 1.0.469 that allows a back-end user with upload file privileges to upload SVG files without any processing of the...
October CMS Permission and Access Control Issues Vulnerability
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October 1.0.319 and versions prior to 1.0.470, which stems from the fact that back-end users with the default "Publisher" system role can create a...
October CMS Security Breach
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in versions prior to October CMS v1.0.470 and prior to v1.1.1, which stems from an enabled enableSafeMode that allows specific Twig code to be writte...
October CMS Path Traversal Vulnerability
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October CMS versions prior to 1.0.421 and 1.0.469, which can be exploited by an attacker to read local files on the October CMS server via a...
October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)
Exploit Title: October CMS Build 465 - Arbitrary File Read Exploit Authenticated Date: 2020-03-31 Exploit Author: Sivanesh Ashok Vendor Homepage: https://octobercms.com/ Version: Build 465 and below Tested on: Windows 10 / XAMPP / October CMS Build 465 CVE: CVE-2020-5295 echo ''' Authenticated...
openSUSE Security Update : java-1_8_0-openj9 (openSUSE-2020-1893)
This update for java-180-openj9 fixes the following issues : -OpenJDK was updated to 8u2732 build 10 with OpenJ9 0.23.0 virtual machine -includes Oracle July 2020 bsc1174157 and October 2020 CPU bsc1177943 - CVE-2020-14556, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579, CVE-2020-14581,...
OPENSUSE-SU-2020:1893-1 Security update for java-1_8_0-openj9
This update for java-180-openj9 fixes the following issues: -OpenJDK was updated to 8u2732 build 10 with OpenJ9 0.23.0 virtual machine -includes Oracle July 2020 bsc1174157 and October 2020 CPU bsc1177943 - CVE-2020-14556, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579, CVE-2020-14581,...
NVIDIA GeForce Experience - October 2020 - Lenovo Support US
No description provided...
Oracle Business Intelligence Publisher Multiple Vulnerabilities (Oct 2020 CPU)
The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.201020, 12.2.1.3.x prior to 12.2.1.3.201020, 12.2.1.4.x prior to 12.2.1.4.201020, or 12.2.5.5.x OAS 5.5 prior to 12.2.5.5.201012. It is, therefore,...
Oracle WebCenter Portal Multiple Vulnerabilities (Oct 2020 CPU)
Binary data oraclewebcenterportalcpuoct2020.nbin...
i.lanyang.tku.edu.tw Cross Site Scripting vulnerability OBB-1471473
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
koledar.zivacenter.si Cross Site Scripting vulnerability OBB-1471106
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
supertortuga.com Cross Site Scripting vulnerability OBB-1470959
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
scoalanegoiesti.ro Cross Site Scripting vulnerability OBB-1470924
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
ociomania.cl Cross Site Scripting vulnerability OBB-1470914
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...