Archive
29 January 2021
Vulnerabilities first published on this day (UTC), newest first.
14 results · Clear filters · Feed
-
Medium 6.5
Regular expression Denial of Service in Markdown plugin
CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abus…
-
Medium —
Users can edit the tags of any discussion
This advisory concerns a vulnerability which was patched and publicly released on October 5, 2020. ### Impact This vulnerability allowed any registered user to edit the tags of any discussion for which they have READ access using the REST API. Users were able…
-
Medium 5.6
Prototype Pollution
This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
-
Medium 6.5
MantisBT Missing Authorization access check in bug_actiongroup.php
An issue was discovered in MantisBT before 2.24.4. A missing access check in bug_actiongroup.php allows an attacker (with rights to create new issues) to use the COPY group action to create a clone, including all bugnotes and attachments, of any private issue…
-
Medium —
MantisBT Incorrect Authorization in bug_actiongroup_page.php
An issue was discovered in MantisBT before 2.24.4. Due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can get access to the Summary fields of private Issues via bug_arr[]= in a crafted bug_actiongroup_page.php URL. (T…
-
Medium 4.3
MantisBT Insecure Storage in manage_proj_edit_page.php
In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them.
-
Medium 4.9
Archer before 6.9 P1 (6.9.0.1) contains an improper access control vulnerability in an API. A remote authenticated mali…
-
Medium 4.3
Archer before 6.8 P2 (6.8.0.2) is affected by a path exposure vulnerability. A remote authenticated malicious attacker …
-
Medium 4.6
Archer before 6.8 P2 (6.8.0.2) is affected by an open redirect vulnerability. A remote privileged attacker may potentia…
-
Medium 5.3
Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could …
-
Medium 6.5
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…
-
Medium 6.5
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…
-
Medium 5.4
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…
-
Medium 6.5
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthor…