CVE-2020-13486

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...

CVE-2020-13486

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...

CVE-2020-13485

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...

Information disclosure

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...

Design/Logic Flaw

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...

CVE-2020-13485

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...

CVE-2020-13485

The Knock Knock plugin for Craft CMS is affected up to version 1.2.7 (pre-1.2.8). The root cause is a flawed IP whitelisting mechanism that trusts the X-Forwarded-For header, allowing an attacker to bypass IP-based access controls. Impact: potential unauthorized access due to bypassed whitelist; ...

CVE-2020-13486

CVE-2020-13486 affects the Knock Knock plugin for Craft CMS (versions before 1.2.8). The root cause is an open redirection vulnerability arising from insufficient validation of redirect parameters, as documented by multiple sources in the connected records. The impact is malicious redirection; ex...

CVE-2020-13486

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...

CVE-2020-13458

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13459

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

CVE-2020-13458

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13459

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

Cross site scripting

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

Cross site request forgery (csrf)

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13458

CVE-2020-13458 affects the Craft CMS Image Resizer plugin prior to 2.0.9. The issue is a CSRF flaw in the log-clear controller action, enabling CSRF exploitation with no authentication and requiring user interaction. CVSSv3.1 base score is 8.8 (HIGH) with network attack vector, low attack complex...

CVE-2020-13458

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13459

The CVE-2020-13459 entry concerns the Image Resizer plugin for Craft CMS (versions before 2.0.9). The vulnerability is a stored XSS in the Bulk Resize action. Affected component: Image Resizer plugin, Craft CMS ecosystem. Root cause details are not provided beyond the stored XSS description in th...

CVE-2020-13459

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

Craft CMS 3 vCard 1.0.0 Remote Code Execution

Exploit Title: CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution Date: 2020-05-18 Exploit Author: Wade Guest Vendor Homepage: https://craftcms.com/ Software Link: https://plugins.craftcms.com/vcard Vulnerability Details: https://gitlab.com/wguest/craftcms-vcard-exploit Version: 1.0.0 Tested o...