CVE-2023-48912

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...

CVE-2023-48912

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...

CVE-2023-48913

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/delete...

CVE-2023-48914

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/add...

Cross site request forgery (csrf)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/add...

Cross site request forgery (csrf)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/delete...

CVE-2023-48913

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/delete...

Dreamer CMS 跨站请求伪造漏洞

Dreamer CMS is a dreamer content management system. A cross-site request forgery vulnerability exists in Dreamer CMS v4.1.3, which stems from the component /admin/archives/delete not adequately verifying whether a request comes from a trusted user, and can be exploited by an attacker to forge a...

CVE-2023-48912

Dreamer CMS v4.1.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/archives/edit component. The CVE entry ties the issue to Dreamer CMS and specifies CSRF as the flaw, but the provided documents do not include a confirmed remediation (patch/version) or exploitation detail...

CVE-2023-48912

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...

Dreamer CMS 跨站请求伪造漏洞

Dreamer CMS is a dreamer content management system by Junnan Wang, an individual developer in China. A cross-site request forgery vulnerability exists in Dreamer CMS version v4.1.3, which originates from a failure to adequately validate whether a request is from a trusted user in the component...

Dreamer CMS Cross-Site Request Forgery Vulnerability

Dreamer CMS is a Dreamer Content Management System by Junnan Wang, an individual developer in China. A cross-site request forgery vulnerability exists in Dreamer CMS version v4.1.3, which stems from a cross-site request forgery CSRF vulnerability contained in the component /admin/archives/edit...

CVE-2023-48914

Affected software: Dreamer CMS v4.1.3. Vulnerability: Cross-Site Request Forgery (CSRF) in the /admin/archives/add component. The root cause is insufficient validation of whether a request originates from a trusted user, enabling an attacker to forge a malicious request that tricks a victim into ...

CVE-2023-48913

Dreamer CMS v4.1.3 is vulnerable to Cross-Site Request Forgery via the /admin/archives/delete component. Root cause: insufficient verification of request origin for a sensitive operation. Impact includes high confidentiality, integrity, and availability risk (CVSSv3.1: 8.8, UI: REQUIRED, ATT&CK n...

CVE-2023-48268

CVE-2023-48268: Mattermost Boards import can be exploited via a specially crafted zip to exhaust resources during archive extraction, causing Denial of Service. The accessible connected sources indicate the issue stems from failing to limit data extracted from compressed archives during board imp...

CVE-2023-48268 Denial of Service via Board Import Zip Bomb

Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip zip bomb...

Mattermost 资源管理错误漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial of service vulnerability that stems from an inability to limit the amount of data extracted from a compressed archive during an import in Mattermost Boards, which can b...

TorchServe ZipSlip

Impact Using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in...

[SECURITY] [DLA 3653-1] libclamunrar security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3653-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 15, 2023 https://wiki.debian.org/LTS -...

python: tarfile module directory traversal

A flaw was found in the Python tarfile module. Extracting a crafted TAR archive with the tarfile.extract or tarfile.extractall functions could lead to a directory traversal vulnerability, resulting in overwrite of arbitrary files...