CVE-2021-21264 Bypass of fix for CVE-2020-26231, Twig sandbox escape

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247. An authenticated backend user with the cms.managepages,...

CVE-2021-21264

CVE-2021-21264 affects October CMS (Laravel-based) and describes a Twig sandbox bypass where an authenticated backend user with cms.manage_pages, cms.manage_layouts, or cms.manage_partials permissions can write PHP code despite cms.enableSafeMode being enabled. The vulnerability mirrors the impac...

PT-2021-14372 · Octobercms +2 · October Cms +1

Impact A bypass of CVE-2020-26231 fixed in 1.0.470/471 and 1.1.1 was discovered that has the same impact as CVE-2020-26231 & CVE-2020-15247: An authenticated backend user with the cms.manage pages, cms.manage layouts, or cms.manage partials permissions who would normally not be permitted to provi...

safe FME Server 跨站脚本漏洞

safe FME Server is an application from safe Canada. A web data conversion application. A security vulnerability exists in safe FME Server that allows remote attackers to gain administrator privileges via the login page by injecting arbitrary web script or HTML...

Prototype Pollution

safe-obj is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...

Prototype Pollution

safe-flat is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype via the unflatten function...

CVE-2021-25927

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25928

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25927

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25928

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

Remote code execution

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25928

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25928

CVE-2021-25928 concerns a prototype pollution vulnerability in the npm package ‘safe-obj’ affecting versions 1.0.0 through 1.0.2. The issue allows an attacker to cause a denial of service and may lead to remote code execution via prototype pollution. Several connected sources corroborate the impa...

CVE-2021-25928

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25927

CVE-2021-25927 describes a prototype-pollution vulnerability in the JavaScript library safe-flat , affecting versions 2.0.0–2.0.1 . The issue allows an attacker to cause a denial of service and may lead to remote code execution. Multiple sources (NVD, Red Hat, GHSA, OSV, Veracode) consistently id...

CVE-2021-25927

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

CVE-2021-25927

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution...

safe-flat 安全漏洞

safe-flat is an application. for safely flattening nested JavaScript objects. A security vulnerability exists in safe-flat versions 2.0.0 through 2.0.1, which allows an attacker to cause a denial of service and possibly remote code execution...

PT-2021-16857 · Safe-Flat · Safe-Flat

Name of the Vulnerable Software and Affected Versions: safe-flat versions 2.0.0 through 2.0.1 Description: The issue allows an attacker to cause a denial of service and may lead to remote code execution due to a prototype pollution vulnerability. Recommendations: For versions 2.0.0 through 2.0.1,...