Cross site request forgery (csrf)

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5640

CVE-2015-5640 relates to baserCMS prior to 3.0.8. Multiple connected sources confirm a vulnerability where a logged-in, authenticated user can modify arbitrary user settings by sending a specially crafted request, effectively an access-control bypass. The impact described across advisories is tha...

CVE-2015-5640

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5641

SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5641

The CVE-2015-5641 entry affects baserCMS prior to 3.0.8, where an authenticated user can inject arbitrary SQL statements (CWE-89) via unspecified vectors. Impact is that a logged-in attacker may execute arbitrary SQL commands against the database. Affected versions include 3.0.0 through 3.0.7; th...

baserCMS vulnerable to SQL injection

Overview baserCMS contains an SQL injection vulnerability. baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability that allows an authenticated user to inject arbitrary SQL statements CWE-89. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated...

JVN#04855224: baserCMS fails to restrict access permissions

baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability where user settings may be changed when processing specially crafted request sent by an attacker logged into the system. Impact User information may be changed to arbitrary values by a logged in attacker...

JVN#79633796: baserCMS vulnerable to SQL injection

baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability that allows an authenticated user to inject arbitrary SQL statements CWE-89. Impact A logged in attacker may execute arbitrary SQL statements. Solution Update the Software Update to the latest version...

CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

Code injection

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

CVE-2012-1248

The CVE affects baserCMS 1.6.15 and earlier, where the vulnerability resides in app/config/core.php. In shared-hosting environments, installations may not be properly segregated, enabling an attacker with admin access on one domain to hijack sessions on another domain. This is a session managemen...

CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

baserCMS vulnerable to session management

Overview baserCMS contains a vulnerability in session management. baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability in session management. Impact If a web server is hosting several websites, and baserCMS are installed on the respective websites, an...

JVN#53465692: baserCMS vulnerable to session management

baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability in session management. Impact If a web server is hosting several websites, and baserCMS are installed on the respective websites, an administrator of a baserCMS can access baserCMS instance of the other...

CVE-2011-2674

BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors...

CVE-2011-2673

Cross-site scripting XSS vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-2674

BaserCMS before 1.6.12 does not properly restrict additions to the membership of the operators group, which allows remote authenticated users to gain privileges via unspecified vectors...

CVE-2011-2673

Cross-site scripting XSS vulnerability in BaserCMS before 1.6.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...