717 matches found
CVE-2010-5278
Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter. NOTE: some of these details are obtaine...
CVE-2010-5278
Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter. NOTE: some of these details are obtaine...
CVE-2010-5278
MODx Revolution 2.0.2-pl (and possibly earlier) is vulnerable to a Local File Inclusion via the class_key parameter in manager/controllers/default/resource/tvs.php when magic_quotes_gpc is disabled. The vulnerability allows an attacker to read arbitrary server files by使用 a directory traversal seq...
CVE-2010-5278: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter. NOTE: some of these details are obtaine...
PT-2012-1488
Name of the Vulnerable Software and Affected Versions MODx Revolution versions 2.0.2-pl and earlier Description A directory traversal issue exists when magic quotes gpc is disabled, allowing remote attackers to read arbitrary files via a .. dot dot in the class key parameter. Recommendations For...
MODX Website Compromise Update: Revolution Still Safe
MODX Revolution is Still Safe After exhaustive investigation, at this point we have determined the recent modx.com security breach used custom code authored specifically for our website. It was not a result of code contained in any core releases of MODX Revolution. While we have taken additional...
MODX Website Compromise
On Wednesday August 29, a hacker exploited a Local File Inclusion LFI vector in an older release of MODX Revolution we had running on one of our servers. This issue had already been fixed as part of the MODX Revolution 2.2.4 release. We locked down the site while we investigated the compromise...
JW Player / SVFP / Poodll / RokBox Cross Site Scripting
Hello list! Earlier I've wrote about Content Spoofing and Cross-Site Scripting vulnerabilities in JW Player http://securityvulns.com/docs28176.html. And I've mentioned that there are near million of web sites with vulnerable flash-file - it's only indexed by Google, and in reality there are much...
MODx Revolution 2.0.2-pl LFI
Local file include vulnerability in MODx classkey parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...
ModX 2.2.0 - Multiple Vulnerabilities
ModX 2.2.0 - Multiple Vulnerabilities Exploit Title: Modx 2.2.0 LFI and Full Path Disclosure Google Dork: if relevant we will automatically add these to the GHDB Date: 13/03/2012 Author: n0tch aka andmuchmore Software Link: http://modx.com/download/ Version: 2.2.0 Tested on: Windows XP/ Windows 7...
ModX 2.2.0 - Multiple Vulnerabilities
Exploit Title: Modx 2.2.0 LFI and Full Path Disclosure Google Dork: if relevant we will automatically add these to the GHDB Date: 13/03/2012 Author: n0tch aka andmuchmore Software Link: http://modx.com/download/ Version: 2.2.0 Tested on: Windows XP/ Windows 7 / Ubuntu +-- LFI --+...
Modx 2.2.0 Local File Inclusion / Path Disclosure
to submit Exploit Title: Modx 2.2.0 LFI and Full Path Disclosure Google Dork: if relevant we will automatically add these to the GHDB Date: 13/03/2012 Author: n0tch aka andmuchmore Software Link: http://modx.com/download/ Version: 2.2.0 Tested on: Windows XP/ Windows 7 / Ubuntu +-- LFI --+...
MODX Evolution 1.0.5 (and prior) Remote Script Execution Vulnerability
Product: MODX Evolution Risk: Very High Severity: Critical Versions: 1.0.5 and all previous releases Vunerability type: Remote Script Execution Report Date: 2012-Feb-16 Fixed Date: 2012-Feb-20 Description A vigilant community member sent us a security notice to let us know that he found a securit...
Vulnerabilities in plugins for MODx CMS, XOOPS, uCoz, Magento and DSP CMS
Hello 3APA3A! Besides tens millions of vulnerable web sites with affected flash files and vulnerable multiple plugins for different engines, which I've wrote about earlier, there are a lot of other vulnerable plugins. Here are new ones some of them are vulnerable to two XSS holes. There are...
MODx < 2.0.3-pl modahsh Parameter XSS
The version of MODx hosted on the remote web server fails to sanitize the 'modahsh' parameter of the 'manager/index.php' script before using it to generate dynamic HTML. By tricking someone into clicking on a specially crafted link, an attacker may be able exploit this to inject arbitrary HTML an...
MODx < 2.0.3-pl class_key Parameter Local File Inclusion
The version of MODx installed on the remote host fails to sanitize user-supplied input to the 'classkey' parameter of the 'manager/controllers/default/resource/tvs.php' script before using it to include PHP code. Using a specially crafted request, a remote, unauthenticated attacker may be able to...
CVE-2010-4883
Cross-site scripting XSS vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter...