4301 matches found
CVE-2020-15248: Incorrect Authorization
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user ha...
CVE-2020-15247: Missing Authorization
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, an authenticated backend user with the cms.managepages, cms.managelayouts, or cms.managepartials permissions who would normally not be...
PT-2020-16360
Name of the Vulnerable Software and Affected Versions October CMS versions prior to 1.0.470 October CMS versions prior to 1.1.1 Description A bypass was discovered that allows an authenticated backend user with the cms.manage pages, cms.manage layouts, or cms.manage partials permissions to write...
October CMS Security Breach
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in versions prior to October CMS v1.0.470 and prior to v1.1.1, which stems from an enabled enableSafeMode that allows specific Twig code to be writte...
October CMS Path Traversal Vulnerability
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October CMS versions prior to 1.0.421 and 1.0.469, which can be exploited by an attacker to read local files on the October CMS server via a...
PT-2020-14311
Name of the Vulnerable Software and Affected Versions October CMS versions 1.0.421 through 1.0.468 Description An attacker can exploit this issue to read local files on an October CMS server via a specially crafted request. The issue is exploitable by unauthenticated users. Recommendations For...
PT-2020-14313
Name of the Vulnerable Software and Affected Versions October CMS versions 1.0.319 through 1.0.470 Description October CMS is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In affected versions, backend users with the default "Publisher" system role have access ...
CVE-2020-26231: Missing Authorization
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-15247 fixed in 1.0.469 and 1.1.0 was discovered that has the same impact as CVE-2020-15247. An authenticated backend user with the cms.managepages, cms.managelayouts, or...
CVE-2020-15249: Improper Neutralization of Input During Web Page Generation
October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.469, backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since S...
October CMS Permission and Access Control Issues Vulnerability
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October 1.0.319 and versions prior to 1.0.470, which stems from the fact that back-end users with the default "Publisher" system role can create a...
October CMS Security Breach
October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October 1.0.319 and versions prior to 1.0.470, which stems from an enabled enableSafeMode that allows specific Twig code to be written to escape t...
October CMS Build 465 - Arbitrary File Read Exploit (Authenticated)
Exploit Title: October CMS Build 465 - Arbitrary File Read Exploit Authenticated Date: 2020-03-31 Exploit Author: Sivanesh Ashok Vendor Homepage: https://octobercms.com/ Version: Build 465 and below Tested on: Windows 10 / XAMPP / October CMS Build 465 CVE: CVE-2020-5295 echo ''' Authenticated...
openSUSE Security Update : java-1_8_0-openj9 (openSUSE-2020-1893)
This update for java-180-openj9 fixes the following issues : -OpenJDK was updated to 8u2732 build 10 with OpenJ9 0.23.0 virtual machine -includes Oracle July 2020 bsc1174157 and October 2020 CPU bsc1177943 - CVE-2020-14556, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579, CVE-2020-14581,...
OPENSUSE-SU-2020:1893-1 Security update for java-1_8_0-openj9
This update for java-180-openj9 fixes the following issues: -OpenJDK was updated to 8u2732 build 10 with OpenJ9 0.23.0 virtual machine -includes Oracle July 2020 bsc1174157 and October 2020 CPU bsc1177943 - CVE-2020-14556, CVE-2020-14577, CVE-2020-14578, CVE-2020-14579, CVE-2020-14581,...
NVIDIA GeForce Experience - October 2020 - Lenovo Support US
No description provided...
Oracle Business Intelligence Publisher Multiple Vulnerabilities (Oct 2020 CPU)
The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.201020, 12.2.1.3.x prior to 12.2.1.3.201020, 12.2.1.4.x prior to 12.2.1.4.201020, or 12.2.5.5.x OAS 5.5 prior to 12.2.5.5.201012. It is, therefore,...
Oracle WebCenter Portal Multiple Vulnerabilities (Oct 2020 CPU)
Binary data oraclewebcenterportalcpuoct2020.nbin...
i.lanyang.tku.edu.tw Cross Site Scripting vulnerability OBB-1471473
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
koledar.zivacenter.si Cross Site Scripting vulnerability OBB-1471106
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
supertortuga.com Cross Site Scripting vulnerability OBB-1470959
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...