BEdita CMS 3.5.0 XSS & CSRF Vulnerabilities

BEdita CMS version 3.5.0 suffers from cross site request forgery and cross site scripting vulnerabilities. BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0,...

BEdita CMS 3.5.0 Cross Site Request Forgery / Cross Site Scripting

BEdita CMS - XSS & CSRF Vulnerability in Version 3.5.0 ---------------------------------------------------------------- Product Information: Software: BEdita CMS Tested Version: 3.5.0, released 19.1.2015 Vulnerability Type: Cross-Site Scripting CWE-79 & Cross-Site Request Forgery, CSRF CWE-352...

CVE-2015-1040

Multiple cross-site scripting XSS vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lrealname field in the editProfile form to index.php/home/profile; the 2 datatitle or 3 datadescription field in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lrealname field in the editProfile form to index.php/home/profile; the 2 datatitle or 3 datadescription field in the...

CVE-2015-1040

Summary (CVE-2015-1040): Multiple XSS vulnerabilities in the administrative backend of BEdita 3.4.0 allow remote authenticated users to inject arbitrary script/HTML via several fields (lrealname in editProfile; data[title] or data[description] in addQuickItem; note text in saveNote; titleBEObject...

CVE-2015-1040

Multiple cross-site scripting XSS vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lrealname field in the editProfile form to index.php/home/profile; the 2 datatitle or 3 datadescription field in the...

CVE-2015-1040: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lrealname field in the editProfile form to index.php/home/profile; the 2 datatitle or 3 datadescription field in the...

Multiple HTML Injection Vulnerabilities in BEdita CMS 'index.php'

BEdita is a web development framework that provides a full-featured content management system. Multiple HTML injection vulnerabilities exist in BEdita CMS 'index.php' because it fails to properly filter user-supplied input. An attacker can execute the provided HTML and script code in the context ...

CMS BEdita 3.4.0 Cross Site Scripting

Advisory: Multiple persistent XSS vulnerabilites in CMS BEdita v. 3.4.0 Advisory ID: SROEADV-2014-10 Author: Steffen Rösemann Affected Software: CMS BEdita v. 3.4.0 Release-Date: 9th-May-2014 Vendor URL: http://www.bedita.com Vendor Status: working on a patch CVE-ID: - ==========================...

BEdita Cross-Site Scripting Vulnerability

BEdita is a web development framework that provides a full-featured content management system. A cross-site scripting vulnerability in controllers/homecontroller.php in versions prior to BEdita 3.1 allows remote attackers to inject arbitrary web script or HTML...

Multiple Cross-Site Request Forgery Vulnerabilities in BEdita

BEdita is a web development framework that provides a full-featured content management system. A cross-site request forgery vulnerability exists in versions of BEdita prior to 3.1, which allows remote attackers to exploit the vulnerability to hijack administrator authentication...

CVE-2010-5315

Multiple cross-site request forgery CSRF vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create categories via a data array to news/saveCategories or 2 modify credentials via a data array to admin/saveUser...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create categories via a data array to news/saveCategories or 2 modify credentials via a data array to admin/saveUser...

CVE-2010-5314

Cross-site scripting XSS vulnerability in controllers/homecontroller.php in BEdita before 3.1 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter to news/index...

CVE-2010-5315

Multiple cross-site request forgery CSRF vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create categories via a data array to news/saveCategories or 2 modify credentials via a data array to admin/saveUser...

CVE-2010-5314

Cross-site scripting XSS vulnerability in controllers/homecontroller.php in BEdita before 3.1 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter to news/index...

CVE-2010-5314

CVE-2010-5314 affects BEdita before 3.1, where an XSS vulnerability exists in controllers/home_controller.php. An attacker can inject arbitrary web script or HTML via the searchstring parameter to news/index. The public-documented impact is remote script/HTML injection, with likely partial integr...

CVE-2010-5315

CVE-2010-5315 concerns CSRF vulnerabilities in the Web CMS framework BEdita prior to version 3.1. The provided documents consistently describe two attack scenarios: (1) creating categories via a data array to news/saveCategories and (2) modifying credentials via a data array to admin/saveUser, wh...

CVE-2010-5314: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in controllers/homecontroller.php in BEdita before 3.1 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter to news/index...

CVE-2010-5315: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators for requests that 1 create categories via a data array to news/saveCategories or 2 modify credentials via a data array to admin/saveUser...