374 matches found
CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
CVE-2019-1010123: Unrestricted Upload of File with Dangerous Type
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape descriptiontrans filed in modx.grid.settings.js, allowing the attacker to inject arbitrary script through it...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize user photo field, allowing the attacker to inject malicious script through it...
Cross-Site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via a document resource such as pagetitle through the update or quick edit action. The Javascript is executed when viewing manager logs...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The vulnerability exists through an extended user field such as Container name or Attribute name, allowing XSS attacks...
Cross site scripting
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...
Design/Logic Flaw
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
CVE-2018-20755
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
Design/Logic Flaw
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
CVE-2018-20755
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
CVE-2018-20756
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...
CVE-2018-20757
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
Design/Logic Flaw
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
CVE-2018-20757
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
CVE-2018-20758
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
CVE-2018-20758
MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description...
CVE-2018-20756
MODX Revolution (through v2.7.0-pl) is affected by a cross-site scripting (XSS) vulnerability via a document resource (e.g., pagetitle) that is mishandled during Update or Quick Edit actions, or when viewing manager logs. The issue is documented across multiple sources (NVD and related advisories...