CVE-2022-27228

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

CVE-2022-27228

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

CVE-2022-27228

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

Code injection

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

EUVD-2022-31737

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

CVE-2022-27228

In the vote aka "Polls, Votes" module before 21.0.100 of Bitrix Site Manager, a remote unauthenticated attacker can execute arbitrary code...

CVE-2022-27228

CVE-2022-27228 affects Bitrix Site Manager’s built-in vote (Polls, Votes) module prior to version 21.0.100. A remote unauthenticated attacker can execute arbitrary code on affected systems due to the module’s vulnerability, with CVSS overall high impact (C/H/I/A all high) reported in multiple sou...

Bitrix Site Manager 输入验证错误漏洞

Bitrix Site Manager is a web site management system from Bitrix USA. A security vulnerability exists in Bitrix Site Manager prior to version 21.0.100. An unauthenticated attacker could remotely execute arbitrary code...

PT-2022-1778

Name of the Vulnerable Software and Affected Versions Bitrix Site Manager versions prior to 21.0.100 Bitrix Site Manager versions 22.0.0 through 22.0.400 Bitrix Site Manager module Landing versions prior to 23.800.0 Description The 'vote' also known as "Polls, Votes" module in Bitrix Site Manager...

1C-Bitrix Site Management Russia 2.0 Open Redirection

Exploit Title : 1C-Bitrix Site Management Russia 2.0 Open Redirection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 05/03/2019 Vendor Homepages : 1c-bitrix.ru bitrix24.com Software Information Link : 1c-bitrix.ru/support/...

Bitrix Site Manager Cross Site Scripting

Hello list! There is Cross-Site Scripting vulnerability in Bitrix Site Manager. ------------------------- Affected products: ------------------------- Vulnerable was the last version of Bitrix Site Manager at 12.06.2015, when I found this vulnerability on web site of Russian terrorists. At that...

Bitrix Site Manager 6/7 Multiple Input Validation Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/33689/info Bitrix Site Manager is prone to multiple input-validation vulnerabilities: - An authentication-bypass vulnerability - A cross-site scripting vulnerability An attacker may leverage these issues to gain...

CVE-2013-6788

The Bitrix e-Store module before 14.0.1 for Bitrix Site Manager uses sequential values for the BITRIXSMSALEUID cookie, which makes it easier for remote attackers to guess the cookie value and bypass authentication via a brute force attack...

CVE-2013-6788

CVE-2013-6788 affects Bitrix Site Manager’s Bitrix e-Store module prior to 14.0.1. The vulnerability stems from sequential BITRIX_SM_SALE_UID cookie values, enabling remote unauthenticated attackers to guess cookie values by brute force and bypass authentication to view or manipulate another user...

User Identity Spoofing in Bitrix Site Manager

Advisory ID: HTB23183 Product: Bitrix Site Manager Vendor: Bitrix, Inc Vulnerable Versions: 12.5.13 and probably prior Tested Version: 12.5.13 Advisory Publication: November 6, 2013 without technical details Vendor Notification: November 6, 2013 Vendor Patch: November 12, 2013 Public Disclosure:...

Bitrix Site Manager 12.5.13 Insufficient Verification

Advisory ID: HTB23183 Product: Bitrix Site Manager Vendor: Bitrix, Inc Vulnerable Versions: 12.5.13 and probably prior Tested Version: 12.5.13 Advisory Publication: November 6, 2013 without technical details Vendor Notification: November 6, 2013 Vendor Patch: November 12, 2013 Public Disclosure:...

Bitrix Site Manager用户身份欺骗漏洞

CVECAN ID: CVE-2013-6788 Bitrix Site Manager是一款web站点管理工具。 Bitrix Site Manager中的预购电子存储模块显示时，没能充分核查数据的真实性，远程未经认证的用户可以更改“BITRIXSMSALEUID”的cookie，浏览其他用户的购物信息和执行某些操作，如添加或删除购物车中的物品。 0 Bitrix Site Manager=12.5.13 厂商补丁： Bitrix ----- 升级"sale"模块到14.0.1版本，请到厂商的主页下载：...

User Identity Spoofing in Bitrix Site Manager

High-Tech Bridge Security Research Lab discovered vulnerability in Bitrix Site Manager, which can be exploited to spoof user's identity and read, modify or delete pre-ordered items in customer's basket. 1 User Identity Spoofing in Bitrix Site Manager: CVE-2013-6788 The vulnerability exists due to...

Content Spoofing and Cross-Site Scripting vulnerabilities in Bitrix Site Manager

Hello 3APA3A! I want to warn you about security vulnerabilities in Bitrix Site Manager. It is commercial CMS. These are Content Spoofing and Cross-Site Scripting vulnerabilities. These holes bypass built-in WAF and all other protections of Bitrix. ------------------------- Affected products:...

Bitrix Site Manager 11.5 XSS / Content Spoofing

Vulnerable are Bitrix Site Manager 11.5 and previous versions. Which consist JW Player Pro. Versions of Bitrix 11.5 after 2012.08.24 must be not affected, because the developers fixed these holes after my informing. As I've checked at main sites of developers, where I found these vulnerabilities,...