Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Vuln : Stored XSS Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of name at "Setinngs" = "Website Settings" in the pimcore service. Proof of Concept...

TYPO3 Licensing Issue Vulnerability (CNVD-2022-17968)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 has a licensing issue vulnerability that stems from a breach of access control in the extension-bound media browser, which could be exploited by an attacker to execute a request to th...

Authorization

An issue was discovered in the pixxio aka pixx.io integration or DAM extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to...

CVE-2021-43562

An issue was discovered in the pixxio aka pixx.io integration or DAM extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can download various content from a remote location and save it ...

Multiple vulnerabilities in extension "pixx.io integration for TYPO3 (DAM)" (pixxio)

The extension fails to restrict the image download to the configured pixx.io DAM URL resulting in Server-side request forgery. As a result of the Server-side request forgery vulnerability, an attacker can download various content from a remote location and save it to a user controlled filename...

damveterinarycentre.co.uk Improper Access Control vulnerability OBB-2234719

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

✍️ Description pimcore is a Open Source Data & Experience Management Platform PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce this package is vulnerable for Stored XSS thru gender tag 🕵️‍♂️ Proof of Concept 💥 Impact This vulnerability is capable of stored xss 📍 Location Gender.phpL21...

Can Data Protection Systems Prevent Data At Rest Leakage?

Protection against insider risks works when the process involves controlling the data transfer channels or examining data sources. One approach involves preventing USB flash drives from being copied or sending them over email. The second one concerns preventing leakage or fraud in which an inside...

CVE-2020-28861

OpenAsset Digital Asset Management DAM 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application...

Sql injection

OpenAssetDigital Asset Management DAM through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection...

CVE-2020-28861

CVE-2020-28861 affects OpenAsset Digital Asset Management (DAM) 12.0.19 and earlier. The vulnerability is an access control flaw on the /Stream/ProjectsCSV endpoint that allows unauthenticated attackers to retrieve potentially sensitive project data. Connected sources indicate vulnerable versions...

CVE-2020-28861

OpenAsset Digital Asset Management DAM 12.0.19 and earlier failed to implement access controls on /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to gain access to potentially sensitive project information stored by the application...

CVE-2020-28860

OpenAsset Digital Asset Management (DAM) up to 12.0.19 is affected by an authenticated blind SQL injection caused by improper sanitization of user input in SQL queries. The vulnerability is triggered via the /AJAXPage/SearchResults endpoint, using the currentSearchItems parameter, allowing an att...

CVE-2020-28859

OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks...

CVE-2020-28857

OpenAsset Digital Asset Management DAM through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks...

Cross site scripting

OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks...

CVE-2020-28859

CVE-2020-28859 affects OpenAsset Digital Asset Management (DAM) up to version 12.0.19. The vulnerability stems from improper input sanitization in multiple parameters/endpoints, enabling cross-site scripting (XSS). NVD describes reflected XSS; PacketStorm notes stored XSS in various fields. Fixed...

CVE-2020-28859

OpenAsset Digital Asset Management DAM through 12.0.19 does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting attacks...

CVE-2020-28858

OpenAsset Digital Asset Management (DAM) is affected by CSRF (CVE-2020-28858). vulnerable: Cloud 12.0.19 and On‑premise 11.2.1; fixed: Cloud 12.0.26 and On‑premise 11.4.10. Root cause: the app did not verify that user actions were intentionally initiated by the user, enabling CSRF across user fun...

CVE-2020-28857

OpenAsset Digital Asset Management (DAM) prior to patches 12.0.23 (Cloud) / 11.4.10 (On‑prem) is vulnerable to stored cross‑site scripting due to incomplete sanitization of user input across multiple parameters and endpoints (e.g., system preferences, project code, user/password regex fields, and...