PHP: уязвимости стека · Страница 126

CVE-2024-46209

A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter.

CVE-2024-35498

A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

• Обновитесь до 1.29.7
• Обновитесь до 2.1.6
• Обновитесь до 2.3.5
• Обновитесь до 3.7.0

PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability of the hyperlink base in the HTML page header. The HTML page is formed without sanitizing the hyperlink base. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

• Обновитесь до 1.29.7
• Обновитесь до 2.1.6
• Обновитесь до 2.3.5
• Обновитесь до 3.7.0

PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have a cross-site scripting (XSS) vulnerability in custom properties. The HTML page is generated without clearing custom properties. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

• Обновитесь до 1.29.7
• Обновитесь до 2.1.6
• Обновитесь до 2.3.5
• Обновитесь до 3.7.0

PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

• Обновитесь до 1.29.7
• Обновитесь до 2.1.6
• Обновитесь до 2.3.5
• Обновитесь до 3.7.0

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Accounting.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Accounting.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

• Обновитесь до 1.29.7
• Обновитесь до 2.1.6
• Обновитесь до 2.3.5
• Обновитесь до 3.7.0

PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the constructor of the `Downloader` class. Using the `/vendor/phpoffice/phpspreadsheet/samples/download.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

• Обновитесь до 1.29.7
• Обновитесь до 2.1.6
• Обновитесь до 2.3.5
• Обновитесь до 3.7.0

PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the `/vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php` file, which leads to the possibility of a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.

• Обновитесь до 1.29.7
• Обновитесь до 2.1.6
• Обновитесь до 2.3.5
• Обновитесь до 3.7.0

phpMyFAQ Vulnerable to Stored HTML Injection at FAQ

phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at `http[:]//localhost/admin/index[.]php?action=editentry`, resulting in a complete disruption of the FAQ page's user interface. By injecting malformed HTML elements styled to cover the entire screen, an attacker can render the page unusable. This injection manipulates the page structure by introducing overlapping buttons, images, and iframes, breaking the intended layout and functionality. Exploiting this issue can lead to Denial of Service for legitimate users, da

WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts

LGSL has a reflected XSS at /lgsl_files/lgsl_list.php

LGSL (Live Game Server List) provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting vulnerability in the `Referer` HTTP header. The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the HTML response without proper sanitization. When crafted malicious input is provided in the `Referer` header, it is echoed back into an HTML attribute in the application’s response. Commit 7ecb839df9358d21f64cdbff5b2536af25a77de1 contains a patch for the issue.

CVE-2024-50703

TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id.

• Обновитесь до 3.1.3.1

CVE-2024-50702

TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager.

• Обновитесь до 3.1.3.1

CVE-2024-50701

TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin.

• Обновитесь до 3.1.3.1

CVE-2024-56527

An issue was discovered in TCPDF before 6.8.0. The Error function lacks an htmlspecialchars call for the error message.

• Обновитесь до 6.6.2+dfsg1-1+deb12u1
• Обновитесь до 6.8.0
• Обновитесь до 6.8.0+dfsg-1

CVE-2024-56522

An issue was discovered in TCPDF before 6.8.0. unserializeTCPDFtag uses != (aka loose comparison) and does not use a constant-time function to compare TCPDF tag hashes.

• Обновитесь до 6.6.2+dfsg1-1+deb12u1
• Обновитесь до 6.8.0
• Обновитесь до 6.8.0+dfsg-1

CVE-2024-56521

An issue was discovered in TCPDF before 6.8.0. If libcurl is used, CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER are set unsafely.

• Обновитесь до 6.8.0
• Обновитесь до 6.8.0+dfsg-1

CVE-2024-56520

An issue was discovered in tc-lib-pdf-font before 2.6.4, as used in TCPDF before 6.8.0 and other products. Fonts are mishandled, e.g., FontBBox for Type 1 and TrueType fonts is misparsed.

• Обновитесь до 2.6.4
• Обновитесь до 6.6.2+dfsg1-1+deb12u1
• Обновитесь до 6.8.0
• Обновитесь до 6.8.0+dfsg-1

CVE-2024-56519

An issue was discovered in TCPDF before 6.8.0. setSVGStyles does not sanitize the SVG font-family attribute.

• Обновитесь до 6.6.2+dfsg1-1+deb12u1
• Обновитесь до 6.8.0
• Обновитесь до 6.8.0+dfsg-1