61 matches found
CVE-2023-50786
Dradis through 4.16.0 allows referencing external images resources over HTTPS, instead of forcing the use of embedded uploaded images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network...
CVE-2023-50786
Dradis through 4.16.0 allows referencing external images resources over HTTPS, instead of forcing the use of embedded uploaded images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network...
CVE-2023-50786
Dradis through 4.16.0 allows referencing external images resources over HTTPS, instead of forcing the use of embedded uploaded images. This can be leveraged by an authorized author to attempt to steal the Net-NTLM hashes of other authors on a Windows domain network...
Dradis 安全漏洞
Dradis is a suite of reporting and collaboration tools for information security teams. A security vulnerability exists in Dradis 4.16.0 and prior versions that stems from allowing references to external images, which could lead to the theft of Net-NTLM hashes from other users on a Windows domain...
CVE-2023-50786
CVE-2023-50786 affects Dradis 4.16.0 and earlier, where references to external HTTPS images are allowed instead of forcing embedded images. This can enable an authorized author to attempt theft of Net-NTLM hashes from other authors on a Windows domain network. Remediation: upgrade to a version th...
CVE-2022-30028
Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token...
CVE-2019-19946
The API in Dradis Pro 3.4.1 allows any user to extract the content of a project, even if this user is not part of the project team...
Malicious code in dradis_brakeman (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Vulnerability fixed in Dradis Pro
Dradis has fixed a vulnerability in Dradis Pro. A malicious party could exploit the vulnerability to perform a cross-site scripting attack. Such an attack can lead to execution of arbitrary code in the context of the browser of the victim, or access sensitive data within that same context of the...
CVE-2023-31223
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars...
Cross site scripting
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars...
CVE-2023-31223
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars...
CVE-2023-31223
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars...
CVE-2023-31223
Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars...
PT-2023-23244 · Dradis · Dradis
Name of the Vulnerable Software and Affected Versions: Dradis versions prior to 4.8.0 Description: The issue allows persistent XSS by authenticated author users, related to avatars. Recommendations: For versions prior to 4.8.0, update to version 4.8.0 or later to resolve the issue. As a temporary...
Dradis 跨站脚本漏洞
Dradis is a suite of reporting and collaboration tools for information security teams. A security vulnerability exists in Dradis versions prior to 4.8.0. An attacker exploited the vulnerability to execute a cross-site scripting attack...
CVE-2023-31223
Dradis pre-4.8.0 is affected by a persistent XSS vulnerability exploitable by authenticated author users through avatars. Root cause relates to avatar handling; impact involves potential corruption of the browser context (XSS) with access to data in that session. Resolution per multiple sources: ...
CVE-2022-30028
Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token...