JVN#46669729 MODx vulnerable to cross-site scripting

MODx provided by the MODx CMS Project is a Contents Management System CMS software. MODx contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update to the latest version according to the information...

Vulnerabilities in FileDownload Snippet for MODx

Здравствуйте 3APA3A! Сообщаю вам о найденных мною Directory Traversal и Full path disclosure уязвимостях в FileDownload Snippet для MODx. Directory Traversal: http://site/assets/snippets/filedownload/download.php?path=YnVpbGRz&fileName=../index.php Данная уязвимость может использоваться для...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to...

CVE-2008-7243

Cross-site request forgery CSRF vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to...

CVE-2008-7242

Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...

CVE-2008-7243

Cross-site request forgery CSRF vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to...

CVE-2008-7243

MODx CMS 0.9.6.1 and 0.9.6.1p1 are affected by a CSRF vulnerability (CVE-2008-7243) that allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. Technical details are limited in the provided documents; the description specifies...

CVE-2008-7242

CVE-2008-7242: Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allow remote attackers to inject arbitrary web script or HTML via a set of parameters (search, a, messagesubject, messagebody on certain pages; highlight, id, email, name, parent on index.php; doc...

CVE-2008-7242

Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...

CVE-2008-7243: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to...

CVE-2008-7242: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...

MODx config.js.php Information Disclosure

The remote web server is running MODx, an open source content management system. The version of MODx installed on the remote host fails to limit access to the 'core/model/modx/processors/system/config.js.php' script before returning the application's configuration settings, including database...

CVE-2008-5941

Cross-site request forgery CSRF vulnerability in MODx 0.9.6.1p2 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors...

CVE-2008-5942

Multiple cross-site scripting XSS vulnerabilities in MODx before 0.9.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the preserveUrls function and 2 "username input." NOTE: vector 2 may be related to CVE-2008-5939...

CVE-2008-5940

SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-5939

Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...

CVE-2008-5938

PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflectbase parameter...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in MODx 0.9.6.1p2 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors...

Remote file inclusion

PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflectbase parameter...