All CVEs — page 429 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This flaw allows a weblog administrator to read files and access internal network addresses by importing a crafted OPML document, due to improper restriction of XML external entity reference in Apache Roller 6.1.5.
This flaw allows unauthenticated attackers to execute arbitrary code by deserializing attacker-controlled bytes through the XML-RPC endpoint in Apache Roller 6.1.5, leading to remote code execution.
The flaw allows unauthenticated attackers to change a critical site configuration, potentially breaking the public frontpage.
The flaw is a Cross-Site Request Forgery (CSRF) vulnerability in Apache Roller 6.1.5, allowing remote attackers to perform state-changing actions on behalf of a logged-in user without their consent. This matters because it can lead to unauthorized actions being performed, compromising user data and system integrity.
This flaw allows an attacker to bypass authentication by capturing and replaying a valid WSSE digest authentication header, gaining the victim's AtomPub authority.
This flaw allows unauthenticated attackers to bind an outstanding request token to an arbitrary user account, including administrators, by submitting an unsigned authorization request. This can lead to unauthorized access and control over sensitive user accounts.
The flaw allows an authenticated user to read, modify, or delete content from other weblogs via the XML-RPC APIs, due to missing permission checks. This is critical as it can lead to unauthorized access and data manipulation.
This flaw allows an attacker to disclose files readable by the Roller process through improperly restricted XML external entity references in Apache Roller 6.1.5.
This flaw allows an authenticated user with authoring rights to bypass authorization and access resources of another weblog, posing a significant security risk in multi-user installations.