4812 matches found
CVE-2024-28191 Contao may have unencoded insert tags in the frontend
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a...
CVE-2024-28191
CVE-2024-28191 (Contao) concerns the Contao CMS. The issue allows injection of insert tags in frontend forms when the submitted data is output on the page in a very specific way, due to insufficient validation in the form generator. Affected versions include Contao 4.x up to 4.13.39 and Contao 5....
CVE-2024-28191 Contao may have unencoded insert tags in the frontend
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a...
CVE-2024-28190 Contao core bundle vulnerable to cross site scripting in the file manager
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files back end and front end, which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 an...
PT-2024-22325
Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 4.13.39 Contao versions 5.0.0 through 5.3.3 Description The issue allows inject tags in frontend forms if the output is structured in a very specific way. It is possible to inject insert tags via the form generato...
CVE-2024-31207
Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...
CVE-2024-31207
CVE-2024-31207 (Vite) : The vulnerability is in Vite’s server.fs.deny logic, which does not deny requests for patterns containing directories. This could allow access to unintended files or paths during development. Affected versions include 2.9.18 and 3.2.10 up to 5.2.6, 5.1.7, 5.0.13, and 4.5.3...
CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories
Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...
CVE-2024-31207 Vite's `server.fs.deny` did not deny requests for patterns with directories
Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...
Authentication Bypass
causal/oidc is vulnerable to Authentication Bypass. The vulnerability is due to improper verification of the OpenID Connect authentication state from the user lookup chain, leading to authentication of any valid frontend user with a non-empty "txoidc" field...
GHSA-HHF8-F5W9-G6VH OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass
The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “txoidc” is not empty. In scenarios...
OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass
The authentication service of the extension does not verify the OpenID Connect authentication state from the user lookup chain. Instead, the authentication service authenticates every valid frontend user from the user lookup chain, where the frontend user field “txoidc” is not empty. In scenarios...
PT-2024-23225 · Typo3 · Openid Connect Authentication Extension For Typo3
Name of the Vulnerable Software and Affected Versions: OpenID Connect Authentication extension for TYPO3 affected versions not specified Description: The issue concerns a security bypass in the authentication service of the OpenID Connect Authentication extension for TYPO3. The authentication...
The vulnerability of the chmod() method in the Apache Doris backend storage and frontend request handler, related to synchronization errors when using shared resources, allows attackers to compromise the integrity of the protected information.
The vulnerability of the chmod method in the Apache Doris backend and frontend request handlers is related to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...
Frontend Dashboard < 2.2.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Description The Frontend Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to...
WCFM – Frontend Manager for WooCommerce < 6.7.9 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Description The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.7.8 due to insufficient input sanitization and output escaping...
The vulnerability of the Apache Doris Backend storage and Frontend request processor lies in the fact that code is loaded without checking its integrity, allowing an attacker to execute arbitrary code.
The vulnerability of the Backend storage and Frontend request processor of Apache Doris lies in the fact that code is loaded without any checks for its integrity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2024-29200
Kimai is a web-based multi-user time-tracking application. The permission viewothertimesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the viewothertimesheet permission to true, on the frontend, users can only see timesheet...
CVE-2024-29775
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vinoth06. Frontend Dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through 2.2.1...