CVE-2016-10038

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove...

CVE-2016-10038

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove...

CVE-2016-10038: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove...

CVE-2016-10037: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id aka dir parameter, related to browser/directory/getlist...

CVE-2016-10039: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles...

PT-2016-4564

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.2-pl Description The issue allows remote attackers to perform local file inclusion, traversal, and manipulation via a crafted dir parameter in the /connectors/index.php file. This is related to the...

PT-2016-4563

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.2-pl Description The issue allows remote attackers to perform local file inclusion, traversal, and manipulation via a crafted dir parameter in the /connectors/index.php file. This is related to browser,...

PT-2016-4562

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.2-pl Description The issue allows remote attackers to perform local file inclusion, traversal, and manipulation via a crafted id also known as dir parameter in the /connectors/index.php file. This is relat...

MODX CMS Detection (HTTP)

HTTP based detection of MODX CMS. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.106458";...

MODX CMS 2.x < 2.5.2 Multiple Vulnerabilities

MODX CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:modx:revolution"; if description...

Revolution 2.5.1 and Prior Multiple Vulnerabilites

Product: MODX Revolution Severity: Moderate Versions: =2.5.1 Vulnerability type: Directory Traversal / SQL Injection Report date: 2016-Nov-4 Fixed date: 2016-Nov-14 Description We received notice that there are several vulnerabilities that include a SQL injection and directory traversal. These...

Evolution 1.1 and Prior Remote Execution

Product: MODX Evolution Risk: Very High Severity: Critical Versions: =1.1 Vulnerability Type: Remote Code Execution Report Date: 2016-November-08 Fixed Date: 2016-November-12 Description The following components distributed with all versions of MODX Evolution and 0.9.x contain a vulnerability, th...

Evo Security Patch 1.0.12 and above

Everyone who is using MODX Evo version 1.0.12 = 1.2 RC1 should see this patch as mandatory You can read the release post here and you can download the patch here All users of Evo that have the "Extras" module installed can download the patch directly via the module, as seen here. For those who...

MODX Revolution: source code security analysis report

Several vulnerabilities were discovered in MODX 'MODX Revolution' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random...

MODX Login Extra Cross Site Scripting

Exploit Title: MODX Cross-Site Scripting on Login Screen Date: 2015/11/24 Exploit Author: fenceposterror Vendor Homepage: http://modx.com Version: MODX Login Extra before Version 1.9.1. CVE : 2015-6588 POST /login.html?a" HTTP/1.1 Host: vulnerable-installation.tld Accept:...

ModX Revolution 2.3.5-pl Cross Site Scripting Vulnerability

ModX Revolution version 2.3.5-pl suffers from a reflective cross site scripting vulnerability. ModX Revolution 2.3.5-pl: Reflected Cross Site Scripting Vulnerability Security Advisory – Curesec Research Team 1. Introduction Affected Product: ModX Revolution 2.3.5-pl Fixed in: not fixed Fixed...

ModX Revolution 2.3.5-pl Cross Site Scripting

ModX Revolution 2.3.5-pl: Reflected Cross Site Scripting Vulnerability Security Advisory – Curesec Research Team 1. Introduction Affected Product: ModX Revolution 2.3.5-pl Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: Reflected XSS Remote...

MODX Revolution 2.3.3-pl Cross Site Scripting

Affected Vendor: http://modx.com/ Date: 08/05/2015 Creditee: http://osvdb.org/creditees/13518-vadodil-joel-varghese Type of vulnerability: Multiple Cross Site Scripting Vulnerability Tested on: Windows 8.1 Product: MODX Revolution Version: 2.3.3-pl "Content" field in create new resources...

MODX Revolution <= 2.3.2 XSS Vulnerability

MODX Revolution is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MODX Revolution-pl Cross-Site Scripting Vulnerability

MODX Revolution is a content management system that claims to be the most flexible and open and free. A cross-site scripting vulnerability exists in MODX Revolution 2.3.2-pl, which allows remote attackers to inject arbitrary web script or HTML via callback parameters...