46889 matches found
hobbes:fuzz-parse-expr: Stack-buffer-overflow in hobbes::diffRegex
Project: https://github.com/morganstanley/hobbes.git Detailed Report: https://oss-fuzz.com/testcase?key=4831270021693440 Project: hobbes Fuzzing Engine: honggfuzz Fuzz Target: fuzz-parse-expr Job Type: honggfuzzasanhobbes Platform Id: linux Crash Type: Stack-buffer-overflow READ 1 Crash Address:...
GHSA-JM5P-837G-RV8G Wagtail: Improper restriction handling on Page translation API endpoint
Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and...
Wagtail: Improper restriction handling on Page translation API endpoint
Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and...
Wagtail: Improper permission handling when copying snippets
Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. Workaroun...
GHSA-X5CX-W6P2-MXF2 Wagtail: Improper permission handling when copying snippets
Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. Patches Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2. Workaroun...
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Impact The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections...
GHSA-C2XX-CJMH-9Q8F Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Impact The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections...
GHSA-92HV-J533-69WC Wagtail: Identification of documents by SHA1 hash
Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to...
Wagtail: Identification of documents by SHA1 hash
Impact By passing specific HTTP headers to the document serve URL endpoint, an attacker was able to determine whether a document with a given ID matched a specified SHA1 hash, regardless of any permission restrictions on the document or knowing its filename. This could allow an attacker to...
Winter: Reflected XSS through the search query parameter in the backend Table widget
Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...
GHSA-HQ84-X37P-J6Q5 Winter: Reflected XSS through the search query parameter in the backend Table widget
Impact Affected versions of Winter CMS render the search query parameter without HTML encoding inside a block in the backend Table widget partial modules/backend/widgets/table/partials/table.php: php value="" is an HTML raw-text context, so the surrounding value="…" attribute quoting is not a...
Winter: CSRF through AJAX handler names reachable as backend page actions
Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level GET navigation with no CSRF token. Backend\Classes\Controller::actionExists accepted any public method on a controller as a page action, so handler-shaped names were never reserved from URL...
GHSA-P2CH-C2C3-4XM5 Winter: CSRF through AJAX handler names reachable as backend page actions
Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level GET navigation with no CSRF token. Backend\Classes\Controller::actionExists accepted any public method on a controller as a page action, so handler-shaped names were never reserved from URL...
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...
GHSA-5CWR-5JXG-PCF6 Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Impact Users with the backend.managebranding "Customize the back-end" or backend.manageeditor "Manage global code editor preferences" permission can provide custom CSS through Settings → Customize Backend → Styles or Settings → Editor Settings → Markup Styles that is compiled through the LESS CSS...
GHSA-FM29-4MQ3-PHG6 Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Impact Affected versions of Winter CMS did not enforce the ImportExportController behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the importpermissions and exportpermissions configuration keys, enforced ...
GHSA-MPMW-F6H6-3G26 Winter: My Account preview exposes another backend user's profile by record ID
Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...
Winter: My Account preview exposes another backend user's profile by record ID
Impact Backend\Controllers\MyAccount, introduced in v1.2.13, declares an empty $requiredPermissions array so that any authenticated backend user can manage their own account. It implements the FormController behavior, which exposes three routable actions — create, update and preview — that each...
Winter: Stored XSS through Backend List widget image columns
Impact Backend\Widgets\Lists::evalImageTypeValue interpolated the resolved image URL into a single-quoted src attribute without escaping it. Where a list column of type image rendered an attacker-influenced value, that value could break out of the attribute and inject arbitrary attributes —...