CVE-2020-13486

CVE-2020-13486 affects the Knock Knock plugin for Craft CMS (versions before 1.2.8). The root cause is an open redirection vulnerability arising from insufficient validation of redirect parameters, as documented by multiple sources in the connected records. The impact is malicious redirection; ex...

CVE-2020-13459

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

CVE-2020-13458

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13458

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13459

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

Cross site request forgery (csrf)

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

Cross site scripting

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

CVE-2020-13458

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13458

CVE-2020-13458 affects the Craft CMS Image Resizer plugin prior to 2.0.9. The issue is a CSRF flaw in the log-clear controller action, enabling CSRF exploitation with no authentication and requiring user interaction. CVSSv3.1 base score is 8.8 (HIGH) with network attack vector, low attack complex...

CVE-2020-13458

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13459

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

CVE-2020-13459

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

CVE-2020-13459

The CVE-2020-13459 entry concerns the Image Resizer plugin for Craft CMS (versions before 2.0.9). The vulnerability is a stored XSS in the Bulk Resize action. Affected component: Image Resizer plugin, Craft CMS ecosystem. Root cause details are not provided beyond the stored XSS description in th...

PT-2020-13548

Name of the Vulnerable Software and Affected Versions Image Resizer plugin versions prior to 2.0.9 for Craft CMS Description The issue is related to CSRF problems with the log-clear controller action in the affected plugin. Recommendations For versions prior to 2.0.9, update to version 2.0.9 or...

CVE-2020-13459: Improper Neutralization of Input During Web Page Generation

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...

CVE-2020-13458: Cross-Site Request Forgery (CSRF)

An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...

CVE-2020-13486: URL Redirection to Untrusted Site

The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...

CVE-2020-13485: Incorrect Comparison

The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...

PT-2020-13549

Name of the Vulnerable Software and Affected Versions Image Resizer plugin versions prior to 2.0.9 for Craft CMS Description The issue concerns stored XSS in the Bulk Resize action. Recommendations For versions prior to 2.0.9, update to version 2.0.9 or later to resolve the issue. As a temporary...

Craft CMS 3 vCard 1.0.0 Remote Code Execution

Exploit Title: CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution Date: 2020-05-18 Exploit Author: Wade Guest Vendor Homepage: https://craftcms.com/ Software Link: https://plugins.craftcms.com/vcard Vulnerability Details: https://gitlab.com/wguest/craftcms-vcard-exploit Version: 1.0.0 Tested o...