PT-2023-16400 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.5.3 Description: The issue concerns improper authorization in the wallabag GitHub repository. Specifically, the annotations feature allows users to add annotations on highlighted parts of an entry. However, the...

wallabag 授权问题漏洞

wallabag is a web application that allows you to save web pages for later reading. wallabag versions prior to 2.5.3 contain an authorization issue vulnerability that could be exploited by attackers to update other users' comments...

CVE-2023-0609

wallabag prior to 2.5.3 contains an Improper Authorization vulnerability via the export feature that allows insecure direct object reference (IDOR) to view other users’ entries. Root cause: missing ownership validation in the export/download path (exportEntry). Impact: potential exposure of user ...

CVE-2023-0610 Improper Authorization in wallabag/wallabag

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0610 Improper Authorization in wallabag/wallabag

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0610

wallabag/wallabag (pre-2.5.3) is affected by an improper authorization vulnerability in the annotations feature. The issue arises from missing authorization validation on PUT/DELETE requests for annotations, allowing a logged-in user to modify or delete any annotation by ID and potentially disclo...

CVE-2023-0609 Improper Authorization in wallabag/wallabag

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

PT-2023-16399 · Wallabag · Wallabag

Name of the Vulnerable Software and Affected Versions: wallabag versions prior to 2.5.3 Description: The issue concerns an improper authorization vulnerability in the wallabag GitHub repository. It affects the export feature, which allows users to export entries in various formats, such as PDF,...

wallabag 授权问题漏洞

wallabag is a web application that allows you to save web pages for later reading. wallabag versions prior to 2.5.3 contain an authorization issue vulnerability that stems from the fact that the exporting entry module is vulnerable to an IDOR attack, which could be exploited to view other users'...

CVE-2023-0609 Improper Authorization in wallabag/wallabag

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CVE-2023-0610 Improper Authorization in wallabag/wallabag

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3...

CSRF leading to delete account

Description wallabag was discovered to contain a Cross-Site Request Forgery CSRF which allows attackers to arbitrarily delete user accounts via /account/delete. Proof of Concept 1. Create a new user. 2. Login as the new user. 3. Open the following HTML file in the browser. html history.pushState'...

GHSA-GVCW-X64M-PFCJ Wallabag cross-site scripting (XSS) vulnerability

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

Wallabag cross-site scripting (XSS) vulnerability

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

Wallabag Application Cross-Site Scripting Vulnerability

Wallabag is a free and open source RSS reader. A cross-site scripting vulnerability exists in the configuration page of the Wallabag application in versions 2.2.3 through 2.3.2, which can be exploited by remote attackers to execute JavaScript code and steal administrator sessions...

Cross site scripting

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

CVE-2018-11352

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

CVE-2018-11352

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

CVE-2018-11352

The vulnerability CVE-2018-11352 affects Wallabag 2.2.3–2.3.2 and is a stored XSS in the configuration page. It allows execution of JavaScript when an administrator visits the config page, requiring authentication and potentially enabling session theft. No remediation details are provided in the ...

CVE-2018-11352

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...