588 matches found
About the Security Notices category
This is a sub-categrory of Announcements for Security Notices. Older security notices can be found in the archived MODX Forums here: https://forums.modx.com/board/8/security-notices 1 post - 1 participant Read full topic...
CVE-2019-1010178
Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...
CVE-2019-1010178
Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...
Design/Logic Flaw
Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...
CVE-2019-1010178
Fred MODX Revolution 1.0.0-beta5 is affected by: Incorrect Access Control - CWE-648. The impact is: Remote Code Execution. The component is: assets/components/fred/web/elfinder/connector.php. The attack vector is: Uploading a PHP file or change data in the database. The fixed version is:...
CVE-2019-1010178
CVE-2019-1010178 affects MODX Revolution ≤ 1.0.0-beta4/β5 via the Fred add-on (assets/components/fred/web/elfinder/connector.php). The root cause is Incorrect Access Control (CWE-648), enabling Remote Code Execution. The attack vector involves uploading a PHP file or altering data in the database...
CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
Design/Logic Flaw
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...
CVE-2019-1010123
MODX Revolution Gallery 1.7.0 is affected by CWE-434 (Unrestricted Upload of File with Dangerous Type). The issue arises from how user parameters are filtered before passing them into the phpthumb class, enabling an attack via a web request to /assets/components/gallery/connector.php to create fi...
MODX setup/ Directory Site Exploit
There is currently an active exploit of sites with an intact MODX Revolution setup/ directory. This can give anyone on the internet complete access to your site and possibly your server with trivial effort. This directory should never be left in place once a site is installed. You can check if yo...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape descriptiontrans filed in modx.grid.settings.js, allowing the attacker to inject arbitrary script through it...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize user photo field, allowing the attacker to inject malicious script through it...
Cross-Site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via a document resource such as pagetitle through the update or quick edit action. The Javascript is executed when viewing manager logs...
Cross-site Scripting (XSS)
modx/revolution is vulnerable to cross-site scripting XSS. The vulnerability exists through an extended user field such as Container name or Attribute name, allowing XSS attacks...
CVE-2018-20755
MODX Revolution through v2.7.0-pl allows XSS via the User Photo field...
Design/Logic Flaw
MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name...
Cross site scripting
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...