588 matches found
CVE-2017-7322
CVE-2017-7322 : MODX Revolution versions 2.5.4-pl and earlier fail to verify X.509 certificates from SSL servers during update and package-installation, allowing a man-in-the-middle to spoof servers and trigger execution of arbitrary code via a crafted certificate. The affected product is MODX Re...
CVE-2017-7323
MODX Revolution 2.5.4-pl and earlier are vulnerable due to the update and package-installation features defaulting to http://rest.modx.com, enabling a man-in-the-middle attack to spoof servers and trigger arbitrary code execution due to the lack of HTTPS protection. The issue affects the update/p...
CVE-2017-7320
MODX Revolution 2.5.4-pl and earlier are affected by a vulnerability in setup/controllers/language.php where the language parameter is not properly constrained. An attacker can supply an invalid value to trigger a Cookie-Bombing denial of service (cookie quota exhaustion) and can also perform HTT...
CVE-2017-7321
CVE-2017-7321 affects MODX Revolution 2.5.4-pl and earlier. The issue is a remote PHP code execution vulnerability in setup/controllers/welcome.php triggered by passing the config_key parameter to the URL setup/index.php?action=welcome. Public records describe it as an arbitrary code execution pa...
CVE-2017-7324
setup/templates/findcore.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the corepath parameter...
CVE-2017-7320
setup/controllers/language.php in MODX Revolution 2.5.4-pl and earlier does not properly constrain the language parameter, which allows remote attackers to conduct Cookie-Bombing attacks and cause a denial of service cookie quota exhaustion, or conduct HTTP Response Splitting attacks with resulta...
CVE-2017-7324
MODX Revolution 2.5.4-pl and earlier are affected by a remote code execution vulnerability in setup/templates/findcore.php, exploitable via the core_path parameter to run arbitrary PHP code. The issue is documented across multiple sources (NVD/CVE-2017-7324, CNVD, osv), indicating the vulnerable ...
MODX Revolution Directory Traversal Vulnerability (CNVD-2016-13239)
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in the /connectors/index.php file in versions of MODX...
MODX Revolution Directory Traversal Vulnerability (CNVD-2016-13240)
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in the /connectors/index.php file in versions of MODX...
MODX Revolution Directory Traversal Vulnerability
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in the /connectors/index.php file in versions of MODX...
Directory traversal
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles...
CVE-2016-10039
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles...
CVE-2016-10038
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove...
CVE-2016-10039
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles...
Directory traversal
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id aka dir parameter, related to browser/directory/getlist...
CVE-2016-10037
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id aka dir parameter, related to browser/directory/getlist...
CVE-2016-10038
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove...
Directory traversal
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove...
CVE-2016-10037
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id aka dir parameter, related to browser/directory/getlist...