1391 matches found
Craft CMS 3.7.36 Password Reset Poisoning Attack Vulnerability
Craft CMS version 3.7.36 suffers from a password reset poisoning vulnerability. An unauthenticated attacker who knows valid email addresses or account names of Craft CMS backend users is able to manipulate the password reset functionality in a way that the registered users of the CMS receive...
Craft CMS 3.7.36 Password Reset Poisoning Attack
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Password Reset Poisoning Attack product: Craft CMS vulnerable version: 3.7.36 and potentially lower fixed version: none, see workaround by vendor CVE number: CVE-2022-299...
Pixel＆tonic Craft CMS 授权问题漏洞
Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, USA. A security vulnerability exists in Craft CMS version 3.7.36, which stems from the presence of a password reset poisoning vulnerability. An attacker could exploit this vulnerability to manipulate the password reset...
Cross-site Scripting in craftcms/cms
Craft CMS before 3.7.29 allows cross-site scripting...
GHSA-7XJ5-FWQR-5378 Cross-site Scripting in craftcms/cms
Craft CMS before 3.7.29 allows cross-site scripting...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
Cross site scripting
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
Pixel＆tonic Craft CMS 跨站脚本漏洞
Pixel & tonic Craft CMS is a content management system CMS from Pixel & Tonic Pixel & tonic USA. A security vulnerability exists in Craft CMS versions prior to 3.7.29 that allows an attacker to execute cross-site scripting...
GHSA-H2RJ-8WGG-MM43 Craft CMS Cross-site Scripting Vulnerability
Craft CMS before 3.6.13 has an XSS vulnerability...
Craft CMS Cross-site Scripting Vulnerability
Craft CMS before 3.6.13 has an XSS vulnerability...
Duplicate Advisory: Path Traversal in the Logs plugin for Craft CMS
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fp63-499m-hq6m. This link is maintained to preserve external references. Original Description The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream ...
GHSA-9CHX-2VQW-8VQ5 Duplicate Advisory: Path Traversal in the Logs plugin for Craft CMS
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fp63-499m-hq6m. This link is maintained to preserve external references. Original Description The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream ...
CVE-2022-23409
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...
CVE-2022-23409
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...
Design/Logic Flaw
The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php...
CVE-2022-23409
CVE-2022-23409 concerns the Craft CMS Logs plugin (Ethercreative Logs) prior to version 3.0.4. Root cause: path traversal through input to actionStream in Controller.php, enabling remote attackers to read arbitrary files. Affected: Logs plugin for Craft CMS, versions before 3.0.4. Impact: unautho...