105 matches found
CVE-2024-28235
The CVE-2024-28235 entry concerns Contao (open-source CMS). Affected: Contao 4.9.0 up to 4.13.39 and 5.x up to 5.3.3. Root cause: when the crawler checks protected pages for broken links, the HTTP client options are applied to all requests, causing the cookie header to be sent to external URLs. I...
Contao 安全漏洞
Contao is an open source content management system CMS developed in PHP. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in Contao version 4.x prior to version 4.13.40 and version 5.x prior to version 5.3.4, which stems from a cookie mark...
PT-2024-22350 · Contao · Contao
Name of the Vulnerable Software and Affected Versions: Contao versions 4.9.0 through 4.13.39 Contao versions 5.0.0 through 5.3.3 Description: The issue arises when checking for broken links on protected pages, causing Contao to send the cookie header to external URLs. The passed options for the...
CVE-2023-46664
Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources behind protected pages...
Protected Pages - Critical - Access bypass - SA-CONTRIB-2023-013
This module enables you to secure any page with a password. The module does not sufficiently restrict access to the page content...
Authentication flaw
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700v3 1.0.4.12010.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service. The issue results from incorrect...
GHSA-JJ2F-57JG-5RM6 MoinMoin Improper Access Control
macroGetval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages. The issue has been fixed on 4a7de0173734...
FatPipe Networks WARP 10.2.2 Authorization Bypass
FatPipe Networks WARP 10.2.2 Authorization Bypass Vendor: FatPipe Networks Inc. Product web page: https://www.fatpipeinc.com Affected version: WARP 10.2.2r38 10.2.2r25 10.2.2r10 10.1.2r60p82 10.1.2r60p71 10.1.2r60p65 10.1.2r60p58s1 10.1.2r60p58 10.1.2r60p55 10.1.2r60p45 10.1.2r60p35 10.1.2r60p32...
NETGEAR 授权问题漏洞
Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. An authorization issue vulnerability exists in multiple NETGEAR router devices, which stems from the minihttpd service in the product not...
Nagios XI 权限许可和访问控制问题漏洞
Nagios XI is a commercial monitoring solution built on Nagios Core, including dashboards, web-based configuration, advanced reporting, and rich data visualization.An insecure privilege vulnerability exists in versions of Nagios XI prior to 5.8.5. An attacker could exploit the vulnerability by...
WordPress 信息泄露漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. An information disclosure vulnerability exists in Wordpress CMS that originates from being used ...
CVE-2021-29450: Exposure of Sensitive Information to an Unauthorized Actor
Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts and pages. This requires at least contributor privileges. This has been patched in WordPress 5.7.1, along with the older affected versions via minor releases...
D-link DSL-2888A 授权问题漏洞
The D-link DSL-2888A is a Unified Services Router from D-link China. An access control error vulnerability exists in the D-Link DSL-2888A devices, which can be exploited by an unauthenticated attacker to bypass authentication and access authenticated pages and features...
CVE-2020-15896
An authentication-bypass issue was discovered on D-Link DAP-1522 devices 1.4x before 1.10b04Beta02. There exist a few pages that are directly accessible by any unauthorized user, e.g., logout.php and login.php. This occurs because of checking the value of NONEEDAUTH. If the value of NONEEDAUTH is...
Torchbox Wagtail Competitive Conditions Issue Vulnerability
Torchbox Wagtail is an open source content management system CMS from Torchbox UK. A security vulnerability exists in Torchbox Wagtail versions prior to 2.7.2 and prior to 2.8.2. An attacker could exploit the vulnerability to obtain a shared password used to protect a page or document...
The vulnerability of the mod_auth_digest component in the Apache HTTP Server allows a hacker to gain unauthorized access to confidential information or execute arbitrary code.
The vulnerability of the modauthdigest component in the Apache HTTP Server is related to insufficient protection of web pages. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information or execute arbitrary code...
CVE-2008-1099
macroGetval in wikimacro.py in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages...
Design/Logic Flaw
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it...
