| CVE-2026-86507 |
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted…
|
6.1
Moyenne
|
28 sept. 2026 |
| CVE-2026-82379 |
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest…
|
7.7
Élevée
|
28 sept. 2026 |
| CVE-2026-82380 |
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform…
|
8.1
Élevée
|
28 sept. 2026 |
| CVE-2026-82381 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
|
5.4
Moyenne
|
28 sept. 2026 |
| CVE-2026-82382 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
|
6.1
Moyenne
|
28 sept. 2026 |
| CVE-2026-82383 |
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to…
|
8.2
Élevée
|
28 sept. 2026 |
| CVE-2026-82384 |
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause…
|
9.8
Critique
|
28 sept. 2026 |
| CVE-2026-82375 |
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a…
|
7.4
Élevée
|
28 sept. 2026 |
| CVE-2026-82376 |
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights…
|
7.7
Élevée
|
28 sept. 2026 |
| CVE-2026-82377 |
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content…
|
9.9
Critique
|
28 sept. 2026 |
| CVE-2026-82378 |
Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote…
|
9.0
Critique
|
28 sept. 2026 |
| CVE-2026-82385 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to…
|
6.5
Moyenne
|
28 sept. 2026 |
| CVE-2026-82386 |
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files…
|
7.7
Élevée
|
28 sept. 2026 |
| CVE-2026-82348 |
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring…
|
7.7
Élevée
|
28 sept. 2026 |
| CVE-2026-82387 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
|
5.4
Moyenne
|
28 sept. 2026 |
| CVE-2026-82546 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an…
|
6.1
Moyenne
|
28 sept. 2026 |
| CVE-2026-91204 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an…
|
6.1
Moyenne
|
28 sept. 2026 |
| CVE-2026-91206 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a…
|
6.1
Moyenne
|
28 sept. 2026 |
| CVE-2025-24859 |
A session management vulnerability exists in Apache Roller before version 6.1.5 where active user sessions are not…
|
2.1
Faible
|
14 avr. 2025 |
| CVE-2024-46911 |
Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller
|
Non notée
|
14 oct. 2024 |
| CVE-2024-25090 |
Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name…
|
Non notée
|
26 juil. 2024 |
| CVE-2023-37581 |
Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all…
|
Non notée
|
6 août 2023 |
| CVE-2021-33580 |
User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to…
|
Non notée
|
18 août 2021 |
| CVE-2018-17198 |
Server-side Request Forgery (SSRF) and File Enumeration vulnerability in Apache Roller 5.2.1, 5.2.0 and earlier…
|
Non notée
|
28 mai 2019 |