3269 matches found
CentOS 8 : firefox (CESA-2020:3557)
The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:3557 advisory. - Mozilla: Integer overflow in nsJPEGEncoder::emptyOutputBuffer CVE-2020-12422 - Mozilla: WebRTC permission prompt could have been bypassed by a...
CVE-2020-35239
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, t...
CVE-2020-35239
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, t...
UBUNTU-CVE-2020-35239
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, t...
CVE-2020-35239
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, t...
Cross site request forgery (csrf)
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, t...
Grammarly: Config override using non-validated query parameter allows at least reflected XSS by injecting configuration into state
Hi, First, I just want to say after spending a few days on your assets that I'm really impressed by the high security standard of the apps exposed. It has not been easy to find issues. I really like the way you've structured your API-routes in a way that almost eliminates a bunch of access issues...
CVE-2020-35239
CVE-2020-35239 affects CakePHP 4.0.x–4.1.3. The CsrfProtectionMiddleware allows method override parameters to bypass CSRF checks by changing the HTTP method to an arbitrary string not in the allowed list, and the route middleware does not verify that this overridden method is an actual HTTP metho...
CVE-2020-35239
Removed by vendor...
PT-2021-11738 · Cakephp · Cakephp
Name of the Vulnerable Software and Affected Versions: CakePHP versions 4.0.x through 4.1.3 Description: A vulnerability exists in the CsrfProtectionMiddleware component, allowing method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is n...
Cloudbees Jenkins Input Validation Error Vulnerability (CNVD-2021-03561)
Cloudbees Jenkins Hudson Labs is the United States CloudBees Cloudbees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed tasks . An input validation error...
CVE-2021-21605
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file...
CVE-2021-21605
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file...
Design/Logic Flaw
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file...
CVE-2021-21605
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file...
CVE-2021-21605
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override the global config.xml file...
CVE-2020-13922
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface...
CVE-2020-13922
Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface...
