Multiple Cross-Site Scripting Vulnerabilities in Geeklog IVYWE

geeklog is an open source content management system CMS. Multiple cross-site scripting vulnerabilities exist in Geeklog IVYWE. Because the program fails to properly perform user-supplied input, an attacker could exploit the vulnerabilities to execute arbitrary script code in a trusted user's...

Geeklog IVYWE edition contains a cross-site scripting vulnerability

Overview Geeklog is an open source content management system CMS. Geeklog IVYWE edition contains a cross-site scripting CWE-79 vulnerability. Satoshi Ogawa of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

JVN#09836883: Geeklog IVYWE edition contains a cross-site scripting vulnerability

Geeklog is an open source content management system CMS. Geeklog IVYWE edition contains a cross-site scripting CWE-79 vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Apply the Patch Apply the appropriate patch according to the information provided by...

Geeklog < 1.4.0 - Multiple Vulnerabilities

Geeklog Multiple Vulnerabilities Vendor: Geeklog Product: Geeklog Version: = 1.4.0 Website: http://www.geeklog.net/ BID: 16755 CVE: CVE-2006-0823 OSVDB: 23348 23349 SECUNIA: 18920 PACKETSTORM: 44070 Description: Geeklog is one of the most popular content management systems available today. Geeklo...

Geeklog 1.4.0 - Multiple Vulnerabilities

Geeklog 1.4.0 - Multiple Vulnerabilities Geeklog Multiple Vulnerabilities Vendor: Geeklog Product: Geeklog Version: = 1.4.0 Website: http://www.geeklog.net/ BID: 16755 CVE: CVE-2006-0823 OSVDB: 23348 23349 SECUNIA: 18920 PACKETSTORM: 44070 Description: Geeklog is one of the most popular content...

Geeklog 2.1.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications Geeklog 2.1.0 - Command Injection, XSS, Command Injection Vulnerabilities Overview The admin area of Geeklog suffers from two vulnerabilities that can lead to code execution: OS Command Injection and Upload of Files with Dangerous Type. The...

Geeklog 2.1.0 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Geeklog 2.1.0 Fixed in: 2.1.1b3 Fixed Version Link: https://www.geeklog.net/filemgmt/visit.php/1156 Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor:...

Geeklog 2.1.0 Command Injection

!/usr/local/bin/python Exploit for geeklog-2.1.0 OS Command Injection vulnerability An admin account is required to use this exploit Curesec GmbH import sys import re import argparse import requests requires requests lib parser = argparse.ArgumentParser parser.addargument"url", help="base url to...

Geeklog 2.1.0 Command Injection

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Geeklog 2.1.0 Fixed in: 2.1.1b3 Fixed Version Link: https://www.geeklog.net/filemgmt/visit.php/1156 Vendor Contact: [email protected] Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to...

Geeklog <= 1.5.2 'usersettings.php' SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/34553/info Geeklog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the...

Geeklog 1.3.5 - Multiple Cross Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/4969/info Geeklog does not filter script code from URL parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a malicious link to the 'index.php' or 'comment.php'...

Geeklog 1.3.5 Calendar Event Form Script Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4974/info Geeklog does not sufficiently sanitize script code from form fields, making it prone to script injection attacks. Attacker-supplied script code may potentially end up in webpages generated by Geeklog and will...

Geeklog <= 1.6.0sr2 - Remote File Upload

No description provided by source. ============================================================================== Geeklog = v1.6.0sr2 - Remote File Upload Discovered: JaL0h Software Site: http://www.geeklog.net Dork: By Geeklog Created this page in +seconds +powered...

Geeklog 1.3.x XSS

No description provided by source. source: http://www.securityfocus.com/bid/8718/info Geeklog is prone to multiple vulnerabilities, including cross-site scripting and SQL injection issues. Exploitation of these issues could permit unauthorized access to user accounts and sensitive information. So...

Geeklog 1.3.x SQL injection

No description provided by source. source: http://www.securityfocus.com/bid/8718/info Geeklog is prone to multiple vulnerabilities, including cross-site scripting and SQL injection issues. Exploitation of these issues could permit unauthorized access to user accounts and sensitive information. So...

Geeklog 1.3.x Authentication SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7742/info Geeklog is reported to be prone to SQL injection attacks during authentication. This is due to insufficient sanitization of cookie values, which could permit an attacker to inject SQL code. This issue could be...

GeekLog <= 1.4.0sr3 f(u)ckeditor - Remote Code Execution Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo Geeklog = 1.4.0sr3 'fuckeditor' remote commands execution\n; echo by rgod [email protected]\n; echo site: http://retrogod.altervista.org\n; //works regardless of any php.ini settings, //fckeditor very old 'mcpuk'...

GeekLog <= 1.4.0sr3 (_CONF[path]) Remote File Include Vulnerabilities

No description provided by source. --------------------------------------------------------------------------- GeekLog = 1.4.0 CONFpath Remote File Include Vulnerabilities --------------------------------------------------------------------------- Google d0rk: powered by geeklog Discovered By...

Geeklog 1.3.7 Profiles.PHP Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/6601/info The Geeklog 'profiles.php' script is prone to multiple cross-site scripting vulnerabilities. This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may crea...

GeekLog 1.3.x HTML Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/8792/info Geeklog has been reported prone to multiple HTML Injection vulnerabilities. The issues have been reported to present themselves due to a lack of sufficient sanitization performed on data that is parsed from foru...