PT-2025-16163 · Apache · Apache Roller

Name of the Vulnerable Software and Affected Versions: Apache Roller versions prior to 6.1.5 Description: A session management vulnerability exists in Apache Roller where active user sessions are not properly invalidated after password changes. When a user's password is changed, either by the use...

Apache Roller Cross-Site Request Forgery Vulnerability (CNVD-2024-47716)

Apache Roller is the United States Apache Apache Foundation of a Java-based multi-user open source blogging system . A cross-site request forgery vulnerability exists in Apache Roller versions prior to 6.1.4, which can be exploited by an attacker to elevate privileges...

CVE-2024-46911

Cross-site Resource Forgery CSRF, Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges...

CVE-2024-46911

Cross-site Resource Forgery CSRF, Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges...

CVE-2024-46911 Apache Roller: Weakness in CSRF protection allows privilege escalation

Cross-site Resource Forgery CSRF, Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges...

CVE-2024-46911

Apache Roller versions prior to 6.1.4 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw that enables privilege escalation . In multi-blog or multi-user environments, the system defaults to trusting weblog owners to publish arbitrary content; combined with a deficiency in CSRF protections...

CVE-2024-46911 Apache Roller: Weakness in CSRF protection allows privilege escalation

Cross-site Resource Forgery CSRF, Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges...

Apache Roller 跨站请求伪造漏洞

Apache Roller is the United States Apache Apache Foundation of a Java-based multi-user open source blogging system . A cross-site request forgery vulnerability exists in Apache Roller versions prior to 6.1.4, which can be exploited by an attacker to elevate privileges...

CVE-2024-46911: Cross-Site Request Forgery (CSRF)

Cross-site Resource Forgery CSRF, Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges...

PT-2024-32280 · Apache · Apache Roller

Name of the Vulnerable Software and Affected Versions: Apache Roller versions prior to 6.1.4 Description: A Cross-site Resource Forgery CSRF and privilege escalation vulnerability exists in Apache Roller. On multi-blog/user Roller websites, weblog owners are trusted to publish arbitrary weblog...

The vulnerability of the User Profile Handler component on the Apache Roller server for creating web blogs allows attackers to execute XSS attacks.

The vulnerability of the User Profile Handler component on the Apache Roller web blog server exists due to the lack of security measures for handling web page structures. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Apache Roller Cross-Site Scripting Vulnerability (CNVD-2024-35670)

Apache Roller is the United States Apache Apache Foundation of a Java-based multi-user open source blogging system. Apache Roller suffers from a cross-site scripting vulnerability that can be exploited by an attacker to obtain cookie-based authentication credentials...

CVE-2024-25090

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted...

CVE-2024-25090 Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted...

CVE-2024-25090 Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted...

CVE-2024-25090

Apache Roller is affected by a cross-site scripting (XSS) vulnerability due to insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description, and blogroll name fields across versions 5.0.0 to 6.1.2. The issue can be exploited by an authenticated user to pe...

CVE-2024-25090 Apache Roller: Insufficient input validation for some user profile and bookmark fields when Roller in untested-users mode

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted...

CVE-2024-25090: Improper Input Validation

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted...

PT-2024-5531 · Apache · Apache Roller

Name of the Vulnerable Software and Affected Versions: Apache Roller versions 5.0.0 through 6.1.2 Description: The issue is caused by insufficient input validation and sanitation in features such as Profile name & screenname, Bookmark name & description, and blogroll name. This allows an...

Apache Roller 输入验证错误漏洞

Apache Roller is the United States Apache Apache Foundation of a Java-based multi-user open source blogging system. Apache Roller suffers from a cross-site scripting vulnerability that can be exploited by an attacker to obtain cookie-based authentication credentials...