Authorization Bypass Through User-Controlled Key

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the saveAsset function. An attacker can gain unauthorized access to modify or transfer assets across restricted volumes by exploiting...

External Control of Assumed-Immutable Web Parameter

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter due to missing sanitization of the return URL requested by the client. This allows an attacker to introduce arbitrary values to a known loc...