374 matches found
CVE-2016-10037
MODX Revolution
CVE-2016-10039
MODX Revolution is affected by CVE-2016-10039 (pre-2.5.2-pl). A directory traversal flaw exists in /connectors/index.php where a crafted dir parameter can cause local file inclusion/traversal/manipulation. The vulnerability is exploitable remotely via standard network access and is tied to the br...
CVE-2016-10038
MODX Revolution up to version 2.5.1 is affected by CVE-2016-10038 through a directory traversal in /connectors/index.php. A remote attacker can craft the dir parameter to trigger local file inclusion/traversal/manipulation. The vulnerability is caused by improper handling of user-controlled dir i...
CVE-2016-10038
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove...
CVE-2016-10037: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted id aka dir parameter, related to browser/directory/getlist...
CVE-2016-10039: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/getfiles...
CVE-2016-10038: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove...
Revolution 2.5.1 and Prior Multiple Vulnerabilites
Product: MODX Revolution Severity: Moderate Versions: =2.5.1 Vulnerability type: Directory Traversal / SQL Injection Report date: 2016-Nov-4 Fixed date: 2016-Nov-14 Description We received notice that there are several vulnerabilities that include a SQL injection and directory traversal. These...
MODX Revolution: source code security analysis report
Several vulnerabilities were discovered in MODX 'MODX Revolution' software: Incorrect User Input Filtration when Connecting to External Files File System Path Manipulation Using Global Variables Incorrect User Input Filtration when Using the unserialize Function Using Insufficiently Random...
ModX Revolution 2.3.5-pl Cross Site Scripting Vulnerability
ModX Revolution version 2.3.5-pl suffers from a reflective cross site scripting vulnerability. ModX Revolution 2.3.5-pl: Reflected Cross Site Scripting Vulnerability Security Advisory – Curesec Research Team 1. Introduction Affected Product: ModX Revolution 2.3.5-pl Fixed in: not fixed Fixed...
ModX Revolution 2.3.5-pl Cross Site Scripting
ModX Revolution 2.3.5-pl: Reflected Cross Site Scripting Vulnerability Security Advisory – Curesec Research Team 1. Introduction Affected Product: ModX Revolution 2.3.5-pl Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: Reflected XSS Remote...
MODX Revolution 2.3.3-pl Cross Site Scripting
Affected Vendor: http://modx.com/ Date: 08/05/2015 Creditee: http://osvdb.org/creditees/13518-vadodil-joel-varghese Type of vulnerability: Multiple Cross Site Scripting Vulnerability Tested on: Windows 8.1 Product: MODX Revolution Version: 2.3.3-pl "Content" field in create new resources...
MODX Revolution <= 2.3.2 XSS Vulnerability
MODX Revolution is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MODX Revolution-pl Cross-Site Scripting Vulnerability
MODX Revolution is a content management system that claims to be the most flexible and open and free. A cross-site scripting vulnerability exists in MODX Revolution 2.3.2-pl, which allows remote attackers to inject arbitrary web script or HTML via callback parameters...
Cross site scripting
Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2014-8992
Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2014-8992
MODX Revolution 2.3.2-pl contains a cross-site scripting (XSS) flaw in the FileAPI.flash.image.swf component that allows remote attackers to inject arbitrary web script or HTML via the callback parameter. This vulnerability is documented across multiple sources (e.g., NVD/CVE-2014-8992; OpenVAS e...
CVE-2014-8992: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in manager/assets/fileapi/FileAPI.flash.image.swf in MODX Revolution 2.3.2-pl allows remote attackers to inject arbitrary web script or HTML via the callback parameter...
CVE-2014-8775
MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie...