1994 matches found
CVE-2022-29933
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must...
CVE-2022-29933
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must...
CVE-2022-29933
Craft CMS up to version 3.7.36 is affected by a password-reset poisoning vulnerability. An unauthenticated attacker who knows a valid username can reset the target account by supplying a crafted HTTP header (X-Forwarded-Host) to the password-reset URL at /index.php?p=admin/actions/users/send-pass...
CVE-2022-29933
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must...
CVE-2022-29933: Weak Password Recovery Mechanism for Forgotten Password
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must...
PT-2022-19917
Name of the Vulnerable Software and Affected Versions Craft CMS versions 3.7.36 and earlier Description The issue allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the...
Craft CMS 3.7.36 Password Reset Poisoning Attack Vulnerability
Craft CMS version 3.7.36 suffers from a password reset poisoning vulnerability. An unauthenticated attacker who knows valid email addresses or account names of Craft CMS backend users is able to manipulate the password reset functionality in a way that the registered users of the CMS receive...
Craft CMS 3.7.36 Password Reset Poisoning Attack
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Password Reset Poisoning Attack product: Craft CMS vulnerable version: 3.7.36 and potentially lower fixed version: none, see workaround by vendor CVE number: CVE-2022-299...
Pixel＆tonic Craft CMS 授权问题漏洞
Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, USA. A security vulnerability exists in Craft CMS version 3.7.36, which stems from the presence of a password reset poisoning vulnerability. An attacker could exploit this vulnerability to manipulate the password reset...
Cross-site Scripting in craftcms/cms
Craft CMS before 3.7.29 allows cross-site scripting...
GHSA-7XJ5-FWQR-5378 Cross-site Scripting in craftcms/cms
Craft CMS before 3.7.29 allows cross-site scripting...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
Cross site scripting
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
CVE-2022-28378
Craft CMS before 3.7.29 allows XSS...
PT-2022-18987
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 3.7.29 Description The issue allows for cross-site scripting XSS, which is a type of attack where an attacker can inject malicious scripts into a website. This can lead to unauthorized access to sensitive data or...
Pixel＆tonic Craft CMS 跨站脚本漏洞
Pixel & tonic Craft CMS is a content management system CMS from Pixel & Tonic Pixel & tonic USA. A security vulnerability exists in Craft CMS versions prior to 3.7.29 that allows an attacker to execute cross-site scripting...