Cross site scripting

Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MODx before 0.9.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the preserveUrls function and 2 "username input." NOTE: vector 2 may be related to CVE-2008-5939...

Sql injection

SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-5940

SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-5939

Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...

CVE-2008-5941

MODx CSRF vulnerability CVE-2008-5941 affects MODx CMS 0.9.6.1p2 and earlier. A remote attacker could modify managed contents if a logged-in user visits a malicious page, enabling unauthorized actions via CSRF. The JVN entry notes that impact occurs when a user views a crafted page while authenti...

CVE-2008-5941

Cross-site request forgery CSRF vulnerability in MODx 0.9.6.1p2 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors...

CVE-2008-5940

MODx contains a SQL injection in index.php (MODx 0.9.6.2 and earlier) that can be triggered when magic_quotes_gpc is disabled, allowing a remote attacker to execute arbitrary SQL via the searchid parameter. Impact: remote attacker could obtain administrative privileges. Affected versions: 0.9.6.2...

CVE-2008-5938

The vulnerability CVE-2008-5938 affects MODx CMS ≤ 0.9.6.2, where PHP remote file inclusion is possible through assets/snippets/reflect/snippet.reflect.php via the reflect_base parameter when magic_quotes_gpc is disabled. This could allow an attacker to execute arbitrary PHP code on the server. C...

CVE-2008-5939

MODx CMS before 0.9.6.3 is affected by XSS in index.php (and related to username input) allowing remote attackers to inject arbitrary script/HTML. CVE-2008-5942 also notes vectors tied to the preserveUrls function. The original disclosure indicates the id parameter is unlikely affected. Remediati...

CVE-2008-5942

MODx CMS prior to 0.9.6.3 has two XSS vectors: (1) preserveUrls and (2) username input. The CVE-2008-5942 entry documents multiple XSS vulnerabilities that allow remote attackers to inject arbitrary scripts/HTML. The issues are tied to MODx before 0.9.6.3; remediation is to upgrade to a fixed ver...

CVE-2008-5942

Multiple cross-site scripting XSS vulnerabilities in MODx before 0.9.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the preserveUrls function and 2 "username input." NOTE: vector 2 may be related to CVE-2008-5939...

CVE-2008-5940: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in MODx 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the searchid parameter. NOTE: some of these details are obtained from third party information...

CVE-2008-5938: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in assets/snippets/reflect/snippet.reflect.php in MODx CMS 0.9.6.2 and earlier, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the reflectbase parameter...

CVE-2008-5939: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in MODx CMS 0.9.6.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in the username field, possibly related to snippet.ditto.php. NOTE: some sources list the id parameter as being affected, but...

CVE-2008-5942: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MODx before 0.9.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the preserveUrls function and 2 "username input." NOTE: vector 2 may be related to CVE-2008-5939...

CVE-2008-5941: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in MODx 0.9.6.1p2 and earlier allows remote attackers to perform unauthorized actions as other users via unknown vectors...

MODx cross-site request forgery vulnerability

Overview MODx, an open source contents management system, contains a cross-site request forgery vulnerability. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

MODx cross-site scripting vulnerability

Overview MODx, an open source contents management system, contains a cross-site scripting vulnerability. MODx, an open source contents management system, contains multiple cross-site scripting vulnerabilities. Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to...

JVN#66828183 MODx cross-site request forgery vulnerability

MODx, an open source contents management system, contains a cross-site request forgery vulnerability. Impact A remote attacker may modify contents managed by MODx if the user views a malicious web page while logged in to MODx. Solution Update the software and change the configuration Apply the...