140 matches found
CVE-2023-0735
CVE-2023-0735 is a CSRF vulnerability in wallabag/wallabag, present in versions prior to 2.5.4. Connected documents specify the root cause as a lack of validations in the account/delete functionality, enabling attacker‑initiated actions on behalf of an authenticated user. The sources consistently...
CVE-2023-0735 Cross-Site Request Forgery (CSRF) in wallabag/wallabag
Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...
wallabag 跨站请求伪造漏洞
wallabag is a web application that allows you to save web pages for later reading. A cross-site request forgery vulnerability exists in wallabag prior to version 2.5.4. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor announcement...
CVE-2023-0735 Cross-Site Request Forgery (CSRF) in wallabag/wallabag
Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...
CVE-2023-0736
Wallabag/wallabag contains a Stored XSS in versions prior to 2.5.4. The vulnerability stems from input in the shared page that can inject JavaScript; a Veracode entry notes attackers could inject and execute malicious JavaScript via the name field. No exploit details are provided beyond this. Rem...
CVE-2023-0736 Cross-site Scripting (XSS) - Stored in wallabag/wallabag
Cross-site Scripting XSS - Stored in GitHub repository wallabag/wallabag prior to 2.5.4...
CVE-2023-0735 Cross-Site Request Forgery (CSRF) in wallabag/wallabag
Cross-Site Request Forgery CSRF in GitHub repository wallabag/wallabag prior to 2.5.4...
wallabag 跨站脚本漏洞
wallabag is a web application that allows you to save web pages for later reading. A cross-site scripting vulnerability exists in wallabag prior to version 2.5.4. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...
wallabag subject to Improper Authorization via annotations
Impact The annotations feature lets users add annotations on highlighted parts of an entry. The controller does not validate authorization on PUT and DELETE requests which lets a logged user modify or delete any annotation using their ID on their endpoints example.org/annotations/id. These...
wallabag contains Improper Authorization via export feature
Description The export feature lets a user export a single entry or a set of entries in a given format e.g. PDF, MOBI, TXT. For example, https://yourinstance.wallabag.org/export/45.pdf will export the entry with id 45 in PDF format. Since wallabag 2.0.0-alpha.1, this feature is vulnerable to an...
GHSA-QWX8-MXXX-MG96 wallabag contains Improper Authorization via export feature
Description The export feature lets a user export a single entry or a set of entries in a given format e.g. PDF, MOBI, TXT. For example, https://yourinstance.wallabag.org/export/45.pdf will export the entry with id 45 in PDF format. Since wallabag 2.0.0-alpha.1, this feature is vulnerable to an...
Improper Authorization
wallabag/wallabag is vulnerable to Improper Authorization. A remote attacker is able to gain access to unauthorized annotations from other users due to insecure direct object references which is made possible because of improper validation of the user permissions...
Improper Authorization
wallabag/wallabag is vulnerable to Improper Authorization. A remote attacker is able to gain access to unauthorized projects from other users due to insecure direct object references which is made possible because of improper validation of the user permissions...
GHSA-H45F-RJVW-2RV2 Withdrawn: wallabag subject to Improper Authorization
Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-qwx8-mxxx-mg96. This link is maintained to preserve external references. Original Description Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...
Withdrawn: wallabag subject to Improper Authorization via annotations
Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-mrqx-mjc4-vfh3. This link is maintained to preserve external references. Original Description Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...
GHSA-XRW3-WQPH-3FXG Withdrawn: wallabag subject to Improper Authorization via annotations
Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-mrqx-mjc4-vfh3. This link is maintained to preserve external references. Original Description Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...
CVE-2023-0609
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...
CVE-2023-0610
Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...
