1366 matches found
BIT-TYPO3-2021-32768
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding...
BIT-MOODLE-2023-46858
Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content are used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."...
CVE-2024-2055
The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user...
CVE-2024-2055
The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user...
Design/Logic Flaw
The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by default, and runs as the root user...
CVE-2024-2055
The Artica Proxy vulnerability CVE-2024-2055 involves the Rich Filemanager feature. When enabled, it does not require authentication and runs as root, exposing an unauthenticated web interface on port 5000/tcp. An attacker can gain complete filesystem access and could modify critical files (e.g.,...
PT-2024-18680 · Unknown · Artica Proxy
Name of the Vulnerable Software and Affected Versions: Artica Proxy affected versions not specified Description: The "Rich Filemanager" feature of Artica Proxy provides a web-based interface for file management capabilities. When the feature is enabled, it does not require authentication by...
Artica Proxy Unauthenticated File Manager Vulnerability
Vulnerability Details Affected Vendor: Artica Affected Product: Artica Proxy Affected Version: 4.40 and 4.50 Platform: Debian 10 LTS CWE Classification: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-552: Files or Directories Accessible to External Parties CVE ID:...
Artica Proxy Security Vulnerability
Artica Proxy is an open source Artica proxy solution from the Spanish company Artica. A security vulnerability exists in Artica Proxy that stems from the Rich Filemanager feature being enabled to run as root user without authentication by default...
CVE-2024-26148
Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of javascript: protocol which can...
Cross site scripting
Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of javascript: protocol which can...
CVE-2024-26148 Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation
Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of javascript: protocol which can...
CVE-2024-26148 Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation
Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of javascript: protocol which can...
PT-2024-4535 · Querybook · Querybook
Name of the Vulnerable Software and Affected Versions: Querybook versions prior to 3.31.1 Description: The issue is related to the Rich Text Editor component in Querybook, which fails to properly validate user input, allowing arbitrary URLs to be entered without necessary validation. This securit...
Data Matters — Is Your API Security Data Rich or Data Poor?
Taking a data-rich approach to security is the most effective way to stay a step ahead of today’s quickly evolving API threats...
[SECURITY] Fedora 39 Update: wireshark-4.0.12-1.fc39
Wireshark allows you to examine protocol data stored in files or as it is captured from wired or wireless WiFi or Bluetooth networks, USB devices, and many other sources. It supports dozens of protocol capture file formats and understands more than a thousand protocols. It has many powerful...
PT-2024-20781 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.1 Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2 before fix pack 15 Description: The doAsUserId URL parameter may be leaked when creating linked content using the WYSIWYG editor while...
JVM rich text icons < 1.2.7 - Subscriber+ Arbitrary File Deletion
Description The JVM Gutenberg Rich Text Icons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.2.6 via the 'file' parameter. This makes it possible for authenticated attackers, with subscriber access and above, to delete arbitrary files...
CVE-2023-51417
Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3...
CVE-2023-51417 WordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload
Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons.This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3...