2913 matches found
CVE-2021-29452 Any logged in user could edit any other logged in user.
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make th...
CVE-2021-29452
CVE-2021-29452 : A flawed privilege check in the a12n-server HAL-Form for editing users (v0.18.0) allowed any logged-in user to edit other users. Patched in v0.18.2. Multiple connected advisories corroborate insecure access controls affecting all users of the package; remediation is upgrade to th...
CVE-2021-26076
The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn...
Cross site scripting
Unvalidated input and lack of output encoding within the Related Posts for WordPress plugin before 2.0.4 lead to a Reflected Cross-Site Scripting XSS vulnerability within the 'lang' GET parameter while editing a post, triggered when users with the capability of editing posts access a malicious UR...
WordPress Related Posts 跨站脚本漏洞
WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Related Posts is a plugin for adding related content to WordPress. A cross-site scripting vulnerability exists in the Related...
Mblog Cross-Site Scripting Vulnerability (CNVD-2021-26163)
Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5 has a cross-site scripting vulnerability , the vulnerability stems from post editing via the post content field . An attacker can use this vulnerability to inject arbitrary Web script or HT...
CVE-2020-19618
Cross Site Scripting XSS vulnerability in mblog 3.5 via the post content field to /post/editing...
Cross site scripting
Cross Site Scripting XSS vulnerability in mblog 3.5 via the post content field to /post/editing...
CVE-2020-19616
Cross Site Scripting XSS vulnerability in mblog 3.5 via the post header field to /post/editing...
CVE-2020-19616
Cross Site Scripting XSS vulnerability in mblog 3.5 via the post header field to /post/editing...
Cross site scripting
Cross Site Scripting XSS vulnerability in mblog 3.5 via the post header field to /post/editing...
CVE-2020-19618
Cross Site Scripting XSS vulnerability in mblog 3.5 via the post content field to /post/editing...
CVE-2020-19618
CVE-2020-19618 affects mblog 3.5, with an XSS in the post editing flow exposed via the post content field on /post/editing. The connected documents confirm the vulnerable component and entry point, but do not provide concrete patch/version details or remediation steps. Exploitation status is not ...
CVE-2020-19616
Cross Site Scripting XSS vulnerability in mblog 3.5 via the post header field to /post/editing...
CVE-2020-19616
CVE-2020-19616 concerns a Cross-Site Scripting (XSS) vulnerability in the open-source Java blog system mblog, reported for version 3.5.0. The flaw is triggered via the post header field when editing a post, specifically through the /post/editing endpoint. The connected sources corroborate the iss...
langhsu mblog 跨站脚本漏洞
Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5 has a cross-site scripting vulnerability , the vulnerability stems from post editing via the post content field . An attacker can use this vulnerability to inject arbitrary Web script or HT...
langhsu mblog 跨站脚本漏洞
Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5.0 suffers from a cross-site scripting vulnerability. Attackers can use the /post/editing post header field to inject arbitrary Web script or HTML...
INSMA Wifi Mini Spy 1080P HD Security IP Camera 代码问题漏洞
INSMA Wifi Mini Spy 1080P HD Security IP Camera is a camera from INSMA USA. A security vulnerability exists in INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B, which can be exploited by an attacker to execute arbitrary code by editing "recdata"...
CVE-2021-20683
Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors...