2136 matches found
MediaWiki 安全漏洞
MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.35.1 and earlier...
PT-2020-17372 · Mediawiki +1 · Mediawiki +2
Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.35.1 Widgets extension for MediaWiki versions through 1.35.1 Description: An issue was discovered in the Widgets extension for MediaWiki, where any user with the ability to edit pages within the Widgets namespace...
Xxe
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the...
XML External Entity in Dashboard Widget
Problem It has been discovered that RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At leas...
CVE-2020-26229
TYPO3 RSS widgets (Dashboard) are affected by an XML External Entity (XXE) issue in TYPO3 10.4.0–10.4.9, enabling XXE processing due to vulnerable XML handling. The issue is considered low risk/limited impact and notable for requiring a backend user account; no public exploitation details are pro...
PT-2020-16358 · Xmlsoft +1 · Libxml2 +1
Name of the Vulnerable Software and Affected Versions: TYPO3 versions 10.4.0 through 10.4.9 Description: The issue concerns XML external entity processing in RSS widgets, which is reasonable but theoretical, as it could not be reproduced with current PHP versions of supported and maintained syste...
TYPO3 代码问题漏洞
TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. TYPO3 suffers from a security vulnerability that stems from insufficient validation of user-supplied XML input in RSS widgets, which can be exploited by a remote user to pass specially...
XML External Entity in Dashboard Widget
It has been discovered that RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions...
GHSA-C722-PV5W-CFG2 Malicious Package in github-jquery-widgets
Version 0.1.2 of github-jquery-widgets contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...
Malicious Package in github-jquery-widgets
Version 0.1.2 of github-jquery-widgets contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...
CloudForms: Business logic bypass through widgets
A business logic flaw was found in Red Hat CloudForms where the read-only values of the Widgets could be altered. An attacker with low privileges could bypass server-side validation by dropping the disabled attribute from the fields...
widgets.zermatt.ch Cross Site Scripting vulnerability OBB-1269242
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, stems from deficiencies in its authentication mechanism. This allows attackers to edit widgets that are only intended for reading purposes.
The vulnerability of the CloudForms Management Engine, a software platform for managing virtual environments, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows an attacker to remotely edit widgets that are only intended to be read-only. This is...
CVE-2020-10778
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior...
CVE-2020-10778
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior...
Input validation
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior...
CVE-2020-10778
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior...
CloudForms: Business logic bypass through widgets
A business logic flaw was found in Red Hat CloudForms where the read-only values of the Widgets could be altered. An attacker with low privileges could bypass server-side validation by dropping the disabled attribute from the fields...
Elementor Page Builder < 2.9.10 - Authenticated Stored XSS
The Elementor Page Builder plugin is susceptible to stored XSS. An author user can create custom links containing XSS payloads or apply custom attributes to widgets which results in XSS. PoC javascript:alert1, JaVaScript:alert1, javas cript:alert1...
Cross-site Scripting (XSS)
django is vulnerable to cross-site scripting XSS. The vulnerability exists as the value of params, used in getcontext, in admin.widgets.py is not properly sanitized...