BookStack 路径遍历漏洞

BookStack is an open source set of BookStackApp Bookstackapp team's platform for building wiki documents using PHP and Laravel. bookstackapp suffers from a security vulnerability that stems from an improper restriction on the pathname of restricted directories in bookstack. An attacker could...

in bookstackapp/bookstack

Description The dompdf chroot option in Bookstack App is set to basepath, which is the Laravel root folder /var/www/bookstack. An attacker can hence load any image file in the Laravel folder /var/www/bookstack or its subdirectories via PDF exports. Proof of Concept 1: Place an image file in...

in bookstackapp/bookstack

Description Bookstack does not use secure Cache-Control headers. Proof of Concept 1: Login to application 2: View a shelf 3: Logout 4: Press the back button of the opened tab to still see that you can view the information about books previous page of your shelf. Impact This issue is capable of...

BookStack Cross-Site Scripting Vulnerability (CNVD-2021-93902)

BookStack is a platform for storing and organizing information and documents. bookStack suffers from a stored cross-site scripting vulnerability. An attacker could use the vulnerability to obtain administrator cookies, among other things...

BookStack Cross-Site Scripting Vulnerability (CNVD-2021-93901)

BookStack, a platform for storing and organizing information and documents, is vulnerable to a storage cross-site scripting vulnerability. An attacker could use this vulnerability to obtain administrator cookies, etc...

CVE-2021-3768

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3767

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3768

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3767

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross site scripting

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross site scripting

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3768

bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3768

CVE-2021-3768 affects BookStack and stems from Improper Neutralization of Input During Web Page Generation, enabling stored Cross-Site Scripting (XSS). The vulnerability affects input handling in bookstack app/book pages and can lead to leakage of administrator cookies and other impacts as descri...

CVE-2021-3767

BookStack (CVE-2021-3767) is affected by a stored Cross-site Scripting (XSS) vulnerability in bookstackapp/bookstack caused by improper neutralization of input during web page generation. Public descriptions and PoCs show injected SVG content (notably via SVG elements and xlink:href) can lead to ...

BookStack 跨站脚本漏洞

BookStack is a platform for storing and organizing information and documents. bookStack suffers from a stored cross-site scripting vulnerability. An attacker could use the vulnerability to obtain administrator cookies, among other things...

BookStack 跨站脚本漏洞

BookStack, a platform for storing and organizing information and documents, is vulnerable to a storage cross-site scripting vulnerability. An attacker could use this vulnerability to obtain administrator cookies, etc...

CVE-2021-3758

bookstack is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-3758

bookstack is vulnerable to Server-Side Request Forgery SSRF...

Server side request forgery (ssrf)

bookstack is vulnerable to Server-Side Request Forgery SSRF...

CVE-2021-3758

CVE-2021-3758 affects BookStack (bookstackapp/bookstack). The vulnerability is an SSRF flaw in how a page exported to PDF handles HTML content (e.g., an tag referencing external resources). The PoC shows server-side requests triggered during PDF export, enabling access to internal resources from...