3055 matches found
CVE-2017-8384
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
CVE-2017-8384
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
CVE-2017-8385
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
CVE-2017-8384
Craft CMS has a vulnerability CVE-2017-8384 (pre-2.6.2976) that enables XSS when HttpRequestService::getSegments() and getActionSegments() return arrays that need not be zero-based. The root cause is tied to an incomplete fix for CVE-2017-8052, per related advisories. Impact is Cross-Site Scripti...
CVE-2017-8383
Craft CMS prior to 2.6.2976 contains an information-disclosure vulnerability where access to files under the craft/app/ directory is not properly restricted. The issue allows potential exposure of sensitive information. Root cause is insufficient access controls within the affected file path. Aff...
CVE-2017-8385
CVE-2017-8385 affects Craft CMS prior to 2.6.2976. The vulnerability is that the forgot-password email URL can be modified by an attacker, indicating a URL forgery/URL tampering issue within the password-reset flow. The available documented impact is the ability to alter the reset URL, with no ex...
CVE-2017-8385
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
PT-2017-18306
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue is related to improper restriction of viewing the contents of files in the craft/app/ folder. This could potentially allow unauthorized access to sensitive information. Recommendations...
PT-2017-18308
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue allows modification of the URL in a forgot-password email message. Recommendations For versions prior to 2.6.2976, update to version 2.6.2976 or later to resolve the issue...
CVE-2017-8383: Undefined Security Weakness
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...
CVE-2017-8384: Improper Neutralization of Input During Web Page Generation
Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...
PT-2017-18307
Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976 Description The issue allows for XSS attacks due to an array returned by HttpRequestService::getSegments and getActionSegments not being zero-based, resulting from an incomplete fix for a previous security...
CVE-2017-8385: Weak Password Recovery Mechanism for Forgotten Password
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...
Craft CMS Cross-Site Scripting Vulnerability
Craft CMS is a content management system CMS developed by Craft. A cross-site scripting vulnerability exists in Craft CMS versions prior to 2.6.2974. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
CVE-2017-8052
Craft CMS before 2.6.2974 allows XSS attacks...
CVE-2017-8052
Craft CMS before 2.6.2974 allows XSS attacks...
Cross site scripting
Craft CMS before 2.6.2974 allows XSS attacks...
CVE-2017-8052
CVE-2017-8052 affects Craft CMS prior to 2.6.2974, enabling XSS. The vulnerability arises in Craft’s handling of user-supplied input; the initial entry assigns a MEDIUM base CVSS (6.1) on CVSS3, with network vector and user interaction required. Public references tie the issue to an incomplete fi...