470 matches found
CVE-2018-19933
Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry...
CVE-2018-19933
Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry...
CVE-2018-19933
Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry...
CVE-2018-19933
Bolt CMS before 3.6.2 is vulnerable to cross-site scripting via the text input click preview button, demonstrated by the Title field of a configured or new entry. Related advisories (GHSA-2G23-QMMP-FVMR, OSV entries) link this XSS to Bolt 3.6.4 and earlier references, including a public exploit/d...
WhiteSource Bolt for GitHub: Free Open Source Vulnerability Management App for Developers
Developers around the world depend on open source components to build their software products. According to industry estimates, open source components account for 60-80% of the code base in modern applications. Collaboration on open source projects throughout the community produces stronger code,...
PackageKit, accountsservice, adwaita, appstream, at, atk, baobab, bolt, brasero, cairo, cheese, clutter, compat, control, dconf, devhelp, ekiga, empathy, eog, evince, evolution, file, flatpak, folks, fontconfig, freetype, fribidi, fwupd, fwupdate, gcr, gdk, gdm, gedit, geoclue2, geocode, gjs, glade, glib, glib2, glibmm24, gnome, gnote, gobject, gom, google, grilo, gsettings, gspell, gssdp, gstreamer1, gtk, gtk3, gtksourceview3, gucharmap, gupnp, gvfs, harfbuzz, json, libappstream, libchamplain, libcroco, libgdata, libgee, libgepub, libgexiv2, libgnomekbd, libgovirt, libgtop2, libgweather, libgxps, libical, libmediaart, libosinfo, libpeas, librsvg2, libsecret, libsoup, libwayland, libwnck3, mozjs52, mutter, nautilus, openchange, osinfo, pango, poppler, python2, rest, rhythmbox, seahorse, shotwell, sushi, totem, upower, vala, valadoc, vino, vte, vte291, wayland, webkitgtk4, xdg, yelp, zenity security update
CentOS Errata and Security Advisory CESA-2018:3140 An update is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
No need for lock picking tools
This is something I knocked up to show how terrible some locks are. I found this one in my garage. It was from when my wife and I went to a Download festival a couple of years back and is a lock from one of those paid-for secure storage places where you can leave your car keys, phone etc. Let's...
Hardware reverse engineering. A tale from the workbench
In line with our previous work on the Tapplock, I decided to have some fun with some electronic locks and ordered a few from a large retail company. Half of these are currently en route to me, on the slowboat from China, but one arrived early. Before I state, let me just say here that I’m not...
CVE-2017-16754
Bolt before 3.3.6 does not properly restrict access to profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php...
CVE-2017-16754
Bolt before 3.3.6 does not properly restrict access to profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php...
Code injection
Bolt before 3.3.6 does not properly restrict access to profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php...
Bolt _profiler access bypass vulnerability
Bolt is a set of open source content management tools developed by the Bolt community. A security vulnerability exists in versions of Bolt prior to 3.3.6 that stems from a failure to properly authenticate access. An attacker could use this vulnerability to bypass security restrictions and gain...
CVE-2017-16754
Bolt CMS before version 3.3.6 does not properly restrict access to the _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php. The issue is described as an improper access control vulnerability in Bolt prior to 3.3.6. The available connected ...
CVE-2017-16754
Bolt before 3.3.6 does not properly restrict access to profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php...
SQL Injection
bolt/bolt is vulnerable to SQL injection attacks. A malicious user can inject arbitrary SQL statements because it fails to use a prepared statement for groupconcatmaxlen query...
Clickjacking Through Frames
bolt/bolt is vulnerable to clickjacking attacks. The vulnerability exists as bolt did not have sameorigin set in the X-Frame-Options header...
Cross-site Scripting (XSS)
bolt/bolt is vulnerable to cross-site scripting XSS attacks. The library does not properly encode translation parameters, allowing a malicious user to inject and execute arbitrary web script...
Cross-site Scripting (XSS)
bolt/bolt is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script when editing the title parameter for content...