717 matches found
MODX Revolution 2.3.1-pl Cross Site Scripting Vulnerability
MODX Revolution version 2.3.1-pl suffers from a reflective cross site scripting vulnerability. Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch:...
MODX Revolution 2.3.1-pl Cross Site Scripting
Advisory ID: HTB23229 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch: September 11, 2014 Public Disclosure: September...
Reflected Cross-Site Scripting (XSS) in MODX Revolution
High-Tech Bridge Security Research Lab discovered vulnerability in MODX Revolution, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Reflected Cross-Site Scripting XSS in MODX Revolution: CVE-2014-5451 The vulnerability exists due to insufficient sanitization of input data...
Critical Login XSS+CSRF Revolution 2.2.1.4 and Prior
Product: MODX Revolution Severity: Critical Versions: 2.0.0–2.2.14 Vulnerability type: CSRF & XSS Report date: 2014-Jul-10 Fixed date: 2014-Jul-15 Description A significant vulnerability was discovered in the Manager login of MODX Revolution that also affects the use of the Login Extra. A malicio...
modx cms 0.9.6.1 - Multiple Vulnerabilities
No description provided by source. WwW.BugReport.ir AmnPardaz Security Research Team Title: MODx CMS Vulnerabilities Vendor: http://modxcms.com Bugs: Source code disclosure, local file inclusion Vulnerable Version: 0.9.6.1 prior versions also may be affected Exploitation: Remote with browser Fix...
MODx 0.9.6.1 'AjaxSearch.php' Local File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/27097/info MODx is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability using directory-traversal strings to execute local scrip...
MODx 0.9.6.1 'htcmime.php' Source Code Information Disclosure Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/27096/info MODx is prone to a vulnerability that allows attackers to access source code because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve...
modx cms <= 0.9.6.2 (rfi/xss) Multiple Vulnerabilities
No description provided by source. :: The Codes Like A Game Anyone Can Play With It,s :: Title: MODx CMS = 0.9.6.2 Multiple Remote Vulne RFI + XSS Vendor:...
MODx CMS <= 0.9.2.1 (FCKeditor) Remote File Include Vulnerability
No description provided by source. +------------------------------------------------------------------------------------------- + MODx CMS 0.9.2.1 basepath Remote File Include Vulnerability +------------------------------------------------------------------------------------------- + Affected...
ModX 2.2.0 - Multiple Vulnerabilities
No description provided by source. Exploit Title: Modx 2.2.0 LFI and Full Path Disclosure Google Dork: if relevant we will automatically add these to the GHDB Date: 13/03/2012 Author: n0tch aka andmuchmore Software Link: http://modx.com/download/ Version: 2.2.0 Tested on: Windows XP/ Windows 7 /...
MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability
No description provided by source. !-- Title: MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability Vendor: MODx, LLC. Product web page: http://www.modxcms.com Affected version: 2.0.4-pl2 public launch 2 Summary: MODx Revolution is a powerful PHP Content Management Framework that...
MODx 0.9.6 index.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/27672/info MODx is prone to an HTML-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...
Important Update to AjaxSearch Exploit in Evo 1.0.13 (and prior)
Last week we announced an exploit found in AjaxSearch that could allow a Remote Code Execution in MODX Evolution. We originally suggested the removal of the index-ajax.php file was a sufficient method to protect your site from vulnerability. It has come to our attention that this was not correct...
MODX Evolution 1.0.13 (and prior) AjaxSearch Vulnerability
Product: MODX Evolution Risk: Very High Severity: Critical Versions: =1.0.13 Vulnerabilty Type: Remote Code Execution Report Date: 2014-May-29 Fixed Date: 2014-June-5 Description The AjaxSearch component distributed with all versions of MODX Evolution and 0.9.x contains a vulnerability that allow...
Multiple Vulnerabilities in MODX Revolution < = MODX 2.2.13-pl
Product description: ============ MODX originally MODx is a free, open source content management system and web application framework for publishing content on the world wide web and intranets. ============ MODX Revolution Blind SQL Injection CVE-2014-2736 ============ The application is vulnerab...
CVE-2014-2736
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...
Sql injection
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...
CVE-2014-2736
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...
CVE-2014-2736
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...
