2418 matches found
GHSA-WVR4-W6CW-4PX8 Craft CMS possibility of brute force attempts
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
Craft CMS possibility of brute force attempts
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
GHSA-F3XR-Q258-H7M9 Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
GHSA-W5Q4-Q7WP-QWW6 Craft CMS XSS Vulnerability
Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...
Craft CMS XSS Vulnerability
Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...
Security update for libxls (moderate)
openSUSE Security Update: Security update for libxls Announcement ID: openSUSE-SU-2022:0142-1 Rating: moderate References: 1192323 Cross-References: CVE-2021-27836 Affected Products: openSUSE Backports SLE-15-SP3 An update that fixes one vulnerability is now available. Description: This update fo...
CVE-2022-30065
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function...
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2974 allows XSS attacks...
GHSA-XV5F-2997-QHRQ Craft CMS XSS Vulnerability
Craft CMS before 2.6.2974 allows XSS attacks...
Craft CMS subject to URL forgery
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
GHSA-9MCW-MWXV-GRWJ Craft CMS XSS Vulnerability
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
GHSA-J27G-R58Q-624W Craft CMS subject to URL forgery
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
GHSA-6PVW-HH48-JX7P Craft CMS XSS Vulnerability
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file...
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file...
CVE-2021-23266
An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator...
CVE-2021-23266
Crafter CMS (Crafter Studio) vulnerability CVE-2021-23266 allows anonymous users to craft a URL whose text is displayed verbatim in the log viewer, enabling misleading admin messages. Root cause: improper output neutralization for logs. Affected component: Crafter Studio log viewer. No remediatio...