JFinalCMS security vulnerabilities

JFinalCMS is a content management system. A cross-site request forgery vulnerability exists in JFinalCMS version 1.0, which stems from the /admin/tag/save file not adequately verifying that a request comes from a trusted user. An attacker can exploit this vulnerability to forge a malicious reques...

CVE-2024-12349: Cross-Site Request Forgery (CSRF)

A vulnerability was found in JFinalCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/tag/save. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the...

PT-2024-36101

Name of the Vulnerable Software and Affected Versions: ARForms Form Builder versions through 1.7.1 Description: The issue is related to improper neutralization of script-related HTML tags in a web page, allowing code injection. This is a Basic XSS vulnerability that affects ARForms Form Builder,...

Debian: Security Advisory (DLA-3984-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-17558 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS version 1.0 Description: The issue is related to a cross-site request forgery CSRF vulnerability in the /admin/tag/save file of the JFinalCMS system. This vulnerability can be exploited remotely, allowing an attacker to perform a CS...

ecryptfs DoS

The vulnerability of the ecryptfs component in the Linux operating system’s kernel is related to an operation that goes beyond the buffer boundaries in the memory, within the function writetag66packet. Exploiting this vulnerability can allow a hacker to cause a service failure...

USN-7136-2 python-django vulnerability

USN-7136-1 fixed a vulnerability in Django. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: jiangniao discovered that Django incorrectly handled the API to strip tags. A remote attacker could possibly use this issue to cause Djan...

SUSE CVE-2024-53987

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

SUSE CVE-2024-53989

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails = 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitiz...

kernel: block: initialize integrity buffer to zero before writing it to media

A flaw was found in the Linux kernel, where it initialized the integrity buffer to zero before writing it to media. Metadata added by biointegrityprep uses plain kmalloc, which leads to random kernel memory being written. Protection Information PI metadata is limited to the app tag not used by...

CVE-2024-53502

Seecms v4.8 was discovered to contain a SQL injection vulnerability in the SEMCMSSeoAndTag.php page...

PT-2024-35763 · Seecms · Seecms

Name of the Vulnerable Software and Affected Versions: Seecms version 4.8 Description: A SQL injection issue was discovered in the SEMCMS SeoAndTag.php page. This issue allows for potential SQL injection attacks. Recommendations: For Seecms version 4.8, consider restricting access to the SEMCMS...

SEMCMS security vulnerabilities

SEMCMS is SEMCMS open source content management system CMS for foreign trade websites with multi-language support. A security vulnerability exists in SEMCMS v4.8, which originates from the SEMCMSSeoAndTag.php file containing a SQL injection vulnerability...

CVE-2024-54123

Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format...

DRUPAL-CONTRIB-2024-064

This module integrates Tarte au citron JS library with Drupal and prevent services to be loaded without user consent. Administrators can enable and configure services which will be managed by Tarte au citron. When Google Tag Manager GTM service is enabled, an attacker can load a GTM container tha...

Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

This module integrates Tarte au citron JS library with Drupal and prevent services to be loaded without user consent. Administrators can enable and configure services which will be managed by Tarte au citron. When Google Tag Manager GTM service is enabled, an attacker can load a GTM container tha...

TCPDF Local File Inclusion vulnerability

Local File Inclusion LFI vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through src tag, potentially exposing sensitive information...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the src tag. An attacker can read arbitrary files from the server's file system. Remediation Upgrade tecnickcom/tcpdf to version 6.7.6 or higher. References - GitHub Commit Credit:...

GHSA-RMV2-8JJC-23XW TCPDF Local File Inclusion vulnerability

Local File Inclusion LFI vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through src tag, potentially exposing sensitive information...

DEBIAN-CVE-2024-51058

Local File Inclusion LFI vulnerability has been discovered in TCPDF 6.7.5. This vulnerability enables a user to read arbitrary files from the server's file system through src tag, potentially exposing sensitive information...