CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-49783 – No permission checks for editing/deleting records with CSV import form
https://notcve.org/view.php?id=CVE-2023-49783
Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions. The likelihood of a user having create permissions but not having edit or delete permissions is low, but it is possible. Note that this doesn't affect any `ModelAdmin` which has had the import form disabled via the `showImportForm` public property. Versions 1.13.19 and 2.1.8 contain a patch for the issue. • https://github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-j3m6-gvm8-mhvw https://www.silverstripe.org/download/security-releases/CVE-2023-49783 • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46754
https://notcve.org/view.php?id=CVE-2023-46754
The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values. El panel de administración de Obl.ong anterior a la versión 1.1.2 permite omitir la autorización porque la función OTP de correo electrónico acepta valores numéricos arbitrarios. • https://github.com/obl-ong/admin/releases/tag/v1.1.2 • CWE-863: Incorrect Authorization •
CVSS: 4.3EPSS: 0%CPEs: 9EXPL: 2CVE-2007-6232 – ftp Admin 0.1.0 - Local File Inclusion / Cross-Site Scripting / Authentication Bypass
https://notcve.org/view.php?id=CVE-2007-6232
Cross-site scripting (XSS) vulnerability in index.php in FTP Admin 0.1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter in an error page action. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en index.php en FTP Admin 0.1.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro error en una acción de página de error. • https://www.exploit-db.com/exploits/4681 https://www.exploit-db.com/exploits/4684 http://secunia.com/advisories/27875 https://exchange.xforce.ibmcloud.com/vulnerabilities/38780 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •