Show filters
27 Total Results
Displaying 11-20 of 27
Sort by:
Attacker Value
Unknown
CVE-2022-42188
Disclosure Date: October 18, 2022 (last updated October 08, 2023)
In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.
0
Attacker Value
Unknown
CVE-2022-42902
Disclosure Date: October 13, 2022 (last updated December 22, 2024)
In Linaro Automated Validation Architecture (LAVA) before 2022.10, there is dynamic code execution in lava_server/lavatable.py. Due to improper input sanitization, an anonymous user can force the lava-server-gunicorn service to execute user-provided code on the server.
0
Attacker Value
Unknown
CVE-2020-23234
Disclosure Date: July 26, 2021 (last updated February 23, 2025)
Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature, which can be bypassed by using HTML event handlers, such as "ontoggle,".
0
Attacker Value
Unknown
CVE-2020-23700
Disclosure Date: July 07, 2021 (last updated February 23, 2025)
Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.
0
Attacker Value
Unknown
CVE-2020-36396
Disclosure Date: July 02, 2021 (last updated February 22, 2025)
A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
0
Attacker Value
Unknown
CVE-2020-36395
Disclosure Date: July 02, 2021 (last updated February 22, 2025)
A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
0
Attacker Value
Unknown
CVE-2020-36397
Disclosure Date: July 02, 2021 (last updated February 22, 2025)
A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
0
Attacker Value
Unknown
CVE-2020-28124
Disclosure Date: April 14, 2021 (last updated February 22, 2025)
Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.
0
Attacker Value
Unknown
CVE-2019-18883
Disclosure Date: November 13, 2019 (last updated November 27, 2024)
XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
0
Attacker Value
Unknown
CVE-2019-17434
Disclosure Date: October 10, 2019 (last updated November 27, 2024)
LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.
0
