Filtered by vendor Hulihanapplications Subscriptions
Filtered by product Diamondlist Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2010-3023 1 Hulihanapplications 1 Diamondlist 2018-10-10 N/A
Multiple cross-site scripting (XSS) vulnerabilities in DiamondList 0.1.6, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) category[description] parameter to user/main/update_category, which is not properly handled by _app/views/categories/index.html.erb; and the (2) setting[site_title] parameter to user/main/update_settings, which is not properly handled by _app/views/settings/_list_settings.rhtml.
CVE-2010-3024 1 Hulihanapplications 1 Diamondlist 2017-08-17 N/A
Multiple cross-site request forgery (CSRF) vulnerabilities in user/main/update_user in DiamondList 0.1.6, and possibly earlier, allow remote attackers to hijack the authentication of administrators for requests that (1) change the administrative password or (2) change the site's configuration.