Access Control Bypass

mezzanine is vulnerable to an Access Control Bypass. The vulnerability is caused by a crafted request to the admin panel allowing unauthorized individuals to bypass restrictions and potentially gain unauthorized access...

CVE-2023-1841

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Honeywell MPA2 Access Panel Web server modules allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05. Honeywell released firmware update package...

CVE-2023-1841

CVE-2023-1841 affects Honeywell MPA2 Access Panel (Web server modules). The issue is an XSS (Cross-site Scripting) vulnerability caused by improper neutralization of input during web page generation. Affected versions are all MPA2 Access Panel firmware prior to R1.00.08.05 ; Honeywell released fi...

CVE-2023-1841 Honeywell MPA2 Web Application XSS vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Honeywell MPA2 Access Panel Web server modules allows XSS Using Invalid Characters.This issue affects MPA2 Access Panel all version prior to R1.00.08.05. Honeywell released firmware update package...

Honeywell MPA2 Access Panel Security Vulnerability

The Honeywell MPA2 Access Panel is a hardware device for access control systems from Honeywell USA. A security vulnerability exists in Honeywell MPA2 Access Panel versions prior to R1.00.08.05 that stems from a cross-site scripting vulnerability that allows the use of invalid characters...

Mezzanine allows attackers to bypass access control mechanisms

An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...

GHSA-QP56-82VP-XQGV Mezzanine allows attackers to bypass access control mechanisms

An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...

CVE-2024-25169

An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...

Design/Logic Flaw

An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...

CVE-2024-25169

An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...

PT-2024-20797

Name of the Vulnerable Software and Affected Versions Mezzanine version 6.0.0 Description An issue in Mezzanine allows attackers to bypass access control mechanisms in the admin panel via a crafted request. Recommendations For Mezzanine version 6.0.0, consider restricting access to the admin pane...

CVE-2024-25169

An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...

Mezzanine Security Breach

Github Mezzanine is a powerful, consistent and flexible content management platform. A security vulnerability exists in Mezzanine version v6.0.0, which stems from a vulnerability that allows an attacker to bypass the access control mechanism in the admin panel via a specially crafted request...

CVE-2024-25169

An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...

CVE-2024-25169

The CVE-2024-25169 issue affects Mezzanine v6.0.0, where an attacker can bypass admin-panel access controls through a crafted request, as reported by Red Hat, Veracode, OSV, GHSA, NVD, CNNVD, and others. The consensus description is that an unauthorized user could bypass restrictions in the admin...

CVE-2024-24721

An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...

Design/Logic Flaw

An issue was discovered on Innovaphone PBX before 14r1 devices. The password form, used to authenticate, allows a Brute Force Attack through which an attacker may be able to access the administration panel...

Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type

TL;DR This vulnerability affects Kirby sites that use the new link field and output the entered link without additional validation or sanitization. The attack commonly requires user interaction by another user or visitor. The link dialog of the writer field is not affected as the writer field...

GHSA-63H4-W25C-3QV4 Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type

TL;DR This vulnerability affects Kirby sites that use the new link field and output the entered link without additional validation or sanitization. The attack commonly requires user interaction by another user or visitor. The link dialog of the writer field is not affected as the writer field...

Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field

TL;DR This vulnerability affects Kirby sites that use the URL field in any blueprint. A successful attack commonly requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel. The attack cannot be automated. The vulnerability is als...