336 matches found
CVE-2014-8773
MODX Revolution 2.x before 2.2.15 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism by 1 omitting the CSRF token or via a 2 long string in the CSRF token parameter...
Modx CMS CSRF Bypass & XSS Vulnerabilities
Public Disclosure - http://hacktivity.websecgeeks.com/modx-csrf-and-xss/ =========================================== Product: MODX Revolution Severity: Critical Versions: 2.0.0–2.2.14 Vulnerability type: CSRF & XSS Report date: 2014-Jul-10 Fixed date: 2014-Jul-15 Description A significant...
CVE-2014-5451
Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression...
Cross site scripting
Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression...
CVE-2014-5451
CVE-2014-5451 is a reflected XSS in MODX Revolution prior to or equal to 2.3.1-pl, caused by insufficient sanitization of input data passed via the HTTP GET parameter a to the path /manager/. The issue affects MODX Revolution v2.3.1-pl and earlier; exploitation can trick an admin to click a craft...
CVE-2014-5451
Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression...
MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting
Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.02.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type:...
MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting
MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass Reflected Cross-Site Scripting Persistent Cross-Site Scripting Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.02.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor...
MODX Revolution 2.2.14 CSRF / XSS Vulnerabilities
MODX Revolution version 2.2.14 suffers from reflective cross site scripting, persistent cross site scripting, and cross site request forgery vulnerabilities. Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without...
Reflected Cross-Site Scripting (XSS) in MODX Revolution
Advisory ID: HTB23229 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch: September 11, 2014 Public Disclosure: September...
MODX Revolution 2.3.1-pl Cross Site Scripting Vulnerability
MODX Revolution version 2.3.1-pl suffers from a reflective cross site scripting vulnerability. Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch:...
MODX Revolution 2.3.1-pl Cross Site Scripting
Advisory ID: HTB23229 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.3.1-pl and probably prior Tested Version: 2.3.1-pl Advisory Publication: August 20, 2014 without technical details Vendor Notification: August 20, 2014 Vendor Patch: September 11, 2014 Public Disclosure: September...
Reflected Cross-Site Scripting (XSS) in MODX Revolution
High-Tech Bridge Security Research Lab discovered vulnerability in MODX Revolution, which can be exploited to perform Cross-Site Scripting XSS attacks. 1 Reflected Cross-Site Scripting XSS in MODX Revolution: CVE-2014-5451 The vulnerability exists due to insufficient sanitization of input data...
Critical Login XSS+CSRF Revolution 2.2.1.4 and Prior
Product: MODX Revolution Severity: Critical Versions: 2.0.0–2.2.14 Vulnerability type: CSRF & XSS Report date: 2014-Jul-10 Fixed date: 2014-Jul-15 Description A significant vulnerability was discovered in the Manager login of MODX Revolution that also affects the use of the Login Extra. A malicio...
MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability
No description provided by source. !-- Title: MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability Vendor: MODx, LLC. Product web page: http://www.modxcms.com Affected version: 2.0.4-pl2 public launch 2 Summary: MODx Revolution is a powerful PHP Content Management Framework that...
Multiple Vulnerabilities in MODX Revolution < = MODX 2.2.13-pl
Product description: ============ MODX originally MODx is a free, open source content management system and web application framework for publishing content on the world wide web and intranets. ============ MODX Revolution Blind SQL Injection CVE-2014-2736 ============ The application is vulnerab...
CVE-2014-2736
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...
Sql injection
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...
CVE-2014-2736
Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...