CVE-2017-8384

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments and getActionSegments need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052...

CVE-2017-8385

CVE-2017-8385 affects Craft CMS prior to 2.6.2976. The vulnerability is that the forgot-password email URL can be modified by an attacker, indicating a URL forgery/URL tampering issue within the password-reset flow. The available documented impact is the ability to alter the reset URL, with no ex...

CVE-2017-8383

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder...

CVE-2017-8384

Craft CMS has a vulnerability CVE-2017-8384 (pre-2.6.2976) that enables XSS when HttpRequestService::getSegments() and getActionSegments() return arrays that need not be zero-based. The root cause is tied to an incomplete fix for CVE-2017-8052, per related advisories. Impact is Cross-Site Scripti...

CVE-2017-8385

Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message...

Craft CMS Cross-Site Scripting Vulnerability

Craft CMS is a content management system CMS developed by Craft. A cross-site scripting vulnerability exists in Craft CMS versions prior to 2.6.2974. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

Cross site scripting

Craft CMS before 2.6.2974 allows XSS attacks...

CVE-2017-8052

Craft CMS before 2.6.2974 allows XSS attacks...

CVE-2017-8052

CVE-2017-8052 affects Craft CMS prior to 2.6.2974, enabling XSS. The vulnerability arises in Craft’s handling of user-supplied input; the initial entry assigns a MEDIUM base CVSS (6.1) on CVSS3, with network vector and user interaction required. Public references tie the issue to an incomplete fi...