CVE-2017-5553

Cross-site scripting XSS vulnerability in plugins/markdownplugin/markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL...

CVE-2017-5553

CVE-2017-5553 describes a Cross-Site Scripting (XSS) vulnerability in b2evolution’s Markdown plugin: plugins/markdown_plugin/_markdown.plugin.php, affecting versions before 6.8.5. The root cause is improper validation/execution of user-supplied input, enabling remote authenticated users to inject...

PT-2017-16567

Name of the Vulnerable Software and Affected Versions b2evolution version 6.8.4-stable Description The issue allows an attacker to bypass a filter rule using ../, enabling them to delete or read any files on the server, as well as determine whether a file exists. Recommendations For b2evolution...

CVE-2017-5539: Improper Limitation of a Pathname to a Restricted Directory

The patch for directory traversal CVE-2017-5480 in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ../ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether...

PT-2017-16573

Name of the Vulnerable Software and Affected Versions b2evolution versions prior to 6.8.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL. Recommendation...

CVE-2017-5553: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in plugins/markdownplugin/markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL...

b2evolution Detection

Detection of b2evolution CMS The script sends a HTTP connection request to the server and attempts to detect the presence of b2evolution CMS and to extract its version. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright...

Cross-site Scripting (XSS)

b2evolution is vulnerable to Cross-site scripting XSS vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the site name...

Cross-site Scripting (XSS)

b2evolution is vulnerable to Cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function...

CVE-2016-7149

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function...

Cross site scripting

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

CVE-2016-7150

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

CVE-2016-7149

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function...

CVE-2016-7150

CVE-2016-7150 is an XSS vulnerability affecting b2evolution (version 6.7.5 and earlier). The issue allows remote authenticated users to inject arbitrary web script or HTML through the site name. Multiple connected sources corroborate XSS in b2evolution with similar details (NVD entry, Veracode su...

CVE-2016-7150

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

CVE-2016-7149

CVE-2016-7149 is a Cross-site Scripting (XSS) vulnerability affecting b2evolution

CVE-2016-7149

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function...

CVE-2016-7149

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function...

CVE-2016-7150: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

CVE-2016-7149: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to the autolink function...