Total 70 security vulnerabilities recorded for b3log software and firmware.
SiYuan is a personal knowledge management system. Prior to version 3.1.16, an arbitrary file read vulnerability exists in Siyuan's `/api/template/rend...
A SQL injection vulnerability was discovered in Siyuan 3.1.11 in /getHistoryItems....
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the ids array parameter in /batchGetBlockAttrs....
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the id parameter at /getAssetContent....
A SQL injection vulnerability has been identified in Siyuan 3.1.11 via the notebook parameter in /searchHistory....
A vulnerability has been found in SiYuan 3.1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file P...
vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet....
Vditor 3.10.3 allows XSS via an attribute of an A element. NOTE: the vendor indicates that a user is supposed to mitigate this via sanitize=true....
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS....
An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component....
Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of...
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13....
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12....
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 1.0.34....
b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header....
b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run...
b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows ...
In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes...
An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor...
In b3log Solo 2.9.3, XSS in the Input page under the Publish Articles menu, with an ID of linkAddress stored in the link JSON field, allows remote att...
b3log Symphony (aka Sym) 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name[] parameter to the /upload URI....
b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header...