JVN#69854312: baserCMS vulnerable to OS command injection

baserCMS is an open-source Contents Management System CMS. baserCMS contains an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed on the server by a logged in attacker. Solution Update the Software Update to the latest version according to the information...

CVE-2015-7769: Improper Neutralization of Special Elements used in an OS Command

baserCMS 3.0.2 through 3.0.8 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2015-5641

SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5640

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

Sql injection

SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

Cross site request forgery (csrf)

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5640

CVE-2015-5640 relates to baserCMS prior to 3.0.8. Multiple connected sources confirm a vulnerability where a logged-in, authenticated user can modify arbitrary user settings by sending a specially crafted request, effectively an access-control bypass. The impact described across advisories is tha...

CVE-2015-5640

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

CVE-2015-5641

The CVE-2015-5641 entry affects baserCMS prior to 3.0.8, where an authenticated user can inject arbitrary SQL statements (CWE-89) via unspecified vectors. Impact is that a logged-in attacker may execute arbitrary SQL commands against the database. Affected versions include 3.0.0 through 3.0.7; th...

CVE-2015-5641

SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5640: Undefined Security Weakness

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request...

PT-2015-7003

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 3.0.8 Description The issue allows remote authenticated users to modify arbitrary user settings via a crafted request. Recommendations For versions prior to 3.0.8, update to version 3.0.8 or later to resolve the issu...

PT-2015-7004

Name of the Vulnerable Software and Affected Versions baserCMS versions prior to 3.0.8 Description The issue allows remote authenticated users to execute arbitrary SQL commands. Recommendations For versions prior to 3.0.8, update to version 3.0.8 or later to resolve the issue...

CVE-2015-5641: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in baserCMS before 3.0.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

baserCMS vulnerable to SQL injection

Overview baserCMS contains an SQL injection vulnerability. baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability that allows an authenticated user to inject arbitrary SQL statements CWE-89. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated...

JVN#04855224: baserCMS fails to restrict access permissions

baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability where user settings may be changed when processing specially crafted request sent by an attacker logged into the system. Impact User information may be changed to arbitrary values by a logged in attacker...

JVN#79633796: baserCMS vulnerable to SQL injection

baserCMS is an open-source Contents Management System CMS. baserCMS contains a vulnerability that allows an authenticated user to inject arbitrary SQL statements CWE-89. Impact A logged in attacker may execute arbitrary SQL statements. Solution Update the Software Update to the latest version...

CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

Code injection

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

CVE-2012-1248

The CVE affects baserCMS 1.6.15 and earlier, where the vulnerability resides in app/config/core.php. In shared-hosting environments, installations may not be properly segregated, enabling an attacker with admin access on one domain to hijack sessions on another domain. This is a session managemen...