CVE-2024-54149

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...

CVE-2024-54149 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...

GHSA-XHW3-4J3M-HQ53 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Impact Affected versions of Winter CMS allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access vi...

Winter security vulnerabilities

Winter is a free and open source content management system based on the Laravel PHP framework by Winter Open Source. A security vulnerability exists in Winter versions prior to 1.2.7, 1.1.11, and 1.0.476, which stems from a user being able to bypass the sandboxing restriction of Twig files by...

PT-2024-36072 · Unknown · Winter Cms

Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.7 Winter CMS versions prior to 1.1.11 Winter CMS versions prior to 1.0.476 Description: The issue allows users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on...

PT-2024-25954 · Cybrosys Techno Solutions · Text Commander

Name of the Vulnerable Software and Affected Versions: Cybrosys Techno Solutions Text Commander module aka text commander versions 16.0 through 16.0.1 Description: A SQL injection vulnerability in the Text Commander module allows a remote attacker to gain privileges via the data parameter to...

UBUNTU-CVE-2019-8934

hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest...

DEBIAN-CVE-2012-2090

Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to 1...

Mandriva Update for hplip MDVSA-2011:013 (hplip)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Update for hplip MDVA-2008:157 (hplip)

Check for the Version of hplip OpenVAS Vulnerability Test Mandriva Update for hplip MDVA-2008:157 hplip Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...