262 matches found
CVE-2026-82380: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation filters accept a request that does not submit the required salt token, validating instead against a...
CVE-2026-82379: Authentication Bypass by Capture-replay
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...
CVE-2026-82376: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with an XML parser that does not disable external entity resolution, leading to disclosure of fil...
CVE-2026-91206: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping...
PT-2026-99796
Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description Improper neutralization of input during web page generation allows a remote attacker to perform reflected cross-site scripting XSS through the optional LDAP comment authenticator. The issue occurs becaus...
CVE-2026-82385: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath...
CVE-2026-82383: Missing Authentication for Critical Function
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value the frontpage weblog selection on any installed instance, because the setup action remains anonymously reachable after installatio...
CVE-2026-82377: Missing Authorization
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because the handlers authenticate the caller but do not verify the caller's permission on the webl...
CVE-2026-82348: Authorization Bypass Through User-Controlled Key
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects multi-user installations where users ar...
PT-2026-99799
Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description An authentication bypass exists due to a capture-replay flaw in the AtomPub API. An attacker can capture a valid WSSE digest authentication header and replay it to gain the authority of the victim. This...
📄 Apache Roller 6.1.2 Cross Site Request Forgery
Apache Roller versions 6.1.2 and below contain a cross site request forgery vulnerability in endpoint /roller/roller-ui/profile!save.rol. This vulnerability allows attackers to arbitrarily update the victim user's profile information e.g., email, full name, locale, timezone via a crafted HTML pag...
Apache Roller < 6.1.5 Insufficient Session Expiration on Password Change (CVE-2025-24859)
According to its self-reported version number, the instance of Apache Roller running on the remote host is prior to 6.1.5. It is, therefore, affected by a session management vulnerability where active user sessions are not properly invalidated after password changes. When a user's password is...
EUVD-2008-6839
Malware in sbrugna...
EUVD-2012-2369
Malware in sbrugna...
EUVD-2019-1007
Malware in sbrugna...
EUVD-2015-0271
Malware in sbrugna...
EUVD-2012-2368
Malware in sbrugna...
EUVD-2013-4095
Malware in sbrugna...