717 matches found
CVE-2014-8992
Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2014-8992
Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2014-8992
Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2014-8992
MODX Revolution 2.3.2-pl contains a cross-site scripting (XSS) flaw in the FileAPI.flash.image.swf component that allows remote attackers to inject arbitrary web script or HTML via the callback parameter. This vulnerability is documented across multiple sources (e.g., NVD/CVE-2014-8992; OpenVAS e...
PT-2014-8772
Name of the Vulnerable Software and Affected Versions MODX Revolution version 2.3.2-pl Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the callback parameter in the manager/assets/fileapi/FileAPI.flash.image.swf file...
CVE-2014-8992: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2014-8775
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...
CVE-2014-8774
Cross-site scripting XSS vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the contextkey parameter...
CVE-2014-8773
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism by 1 omitting the CSRF token or via a 2 long string in the CSRF token parameter...
Design/Logic Flaw
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...
Cross site scripting
Cross-site scripting XSS vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the contextkey parameter...
Cross site request forgery (csrf)
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism by 1 omitting the CSRF token or via a 2 long string in the CSRF token parameter...
CVE-2014-8775
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...
CVE-2014-8773
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism by 1 omitting the CSRF token or via a 2 long string in the CSRF token parameter...
CVE-2014-8774
Cross-site scripting XSS vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the contextkey parameter...
CVE-2014-8773
CVE-2014-8773 affects MODX Revolution 2.x prior to 2.2.15. The vulnerability allows remote attackers to bypass CSRF protection, by either omitting the CSRF token or supplying a long string in the CSRF token parameter. The available sources (NVD, CVE lists) describe the affected product and the ex...
CVE-2014-8775
MODX Revolution 2.x before 2.2.15 is vulnerable due to the session cookie not setting the HTTPOnly flag, allowing remote attackers to access potentially sensitive information via script access. Exploitation details are not provided in the available documents. No explicit remediation/version fix i...
CVE-2014-8774
MODX Revolution 2.x before 2.2.15 contains a cross-site scripting (XSS) vulnerability in manager/index.php, exploitable via the context_key parameter to inject arbitrary web script/HTML. The issue allows remote attackers to leverage XSS; no exploitation details are provided beyond this in the sou...