Xxe

OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability...

CVE-2013-4333

OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability...

CVE-2013-4333

OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability...

CVE-2013-4333

OpenPNE 3.x (versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5) is affected by an XXE/External Entity Injection vulnerability. The connected documents corroborate that the issue is tied to OpenPNE’s vulnerable handling of external entities, but do not provide detailed root-cause analysis, affect...

CVE-2013-4333: Improper Restriction of XML External Entity Reference

OpenPNE 3 versions 3.8.7, 3.6.11, 3.4.21.1, 3.2.7.6, 3.0.8.5 has an External Entity Injection Vulnerability...

PT-2020-7494

Name of the Vulnerable Software and Affected Versions: OpenPNE 3 versions 3.0.8.5, 3.2.7.6, 3.4.21.1, 3.6.11, 3.8.7 Description: The issue is an External Entity Injection, which may allow unauthorized access to sensitive data. Recommendations: For OpenPNE 3 version 3.0.8.5, update to a version th...

OpenPNE 3.8.9 PHP Object Injection Vulnerability

Exploit for php platform in category web applications OpenPNE getRequest-getHost; if $value = sfContext::getInstance-getRequest-getCookie$key $value = unserializebase64decode$value; return $value; User input passed through cookies is not properly sanitized before being used in an unserialize call...

Secunia Research: OpenPNE PHP Object Injection Vulnerability

====================================================================== Secunia Research 20/01/2014 OpenPNE PHP Object Injection Vulnerability ====================================================================== Table of Contents Affected...

CVE-2013-5350

The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...

CVE-2013-5350

The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...

CVE-2013-5350

The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...

CVE-2013-5350

OpenPNE contains a PHP Object Injection vulnerability in opSecurityUser.getRememberLoginCookie() that processes cookies with unserialize(base64_decode()) without proper input filtering. A remote unauthenticated attacker could craft a serialized object in a Cookie header to execute arbitrary PHP c...

OpenPNE vulnerable to PHP Object Injection

Overview OpenPNE contains an issue in processing Cookie headers, which may result in a PHP Object Injection vulnerability. Egidio Romano of Secunia reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A remote,...

JVN#69986880: OpenPNE vulnerable to PHP Object Injection

OpenPNE contains an issue in processing Cookie headers, which may result in a PHP Object Injection vulnerability. Impact A remote, unauthenticated attacker may execute an arbitrary PHP code. Solution Apply an update Update to the latest version according to the information provided by the...

PT-2014-2909

Name of the Vulnerable Software and Affected Versions OpenPNE versions 3.6.13 through 3.6.13 OpenPNE versions 3.8.9 through 3.8.9 Description The issue concerns the "Remember me" feature, which does not properly validate login data in HTTP Cookie headers. This allows remote attackers to conduct P...

CVE-2013-5350: Improper Input Validation

The "Remember me" feature in the opSecurityUser::getRememberLoginCookie function in lib/user/opSecurityUser.class.php in OpenPNE 3.6.13 before 3.6.13.1 and 3.8.9 before 3.8.9.1 does not properly validate login data in HTTP Cookie headers, which allows remote attackers to conduct PHP object...

OpenPNE 'opSecurityUser::getRememberLoginCookie()' PHP代码注入漏洞

BUGTRAQ ID: 65031 CVECAN ID: CVE-2013-5350 OpenPNE是用PHP编写的社交网络服务引擎。 OpenPNE 3.6.13、3.8.9及之前版本/lib/user/opSecurityUser.class.php脚本内定义的 "opSecurityUser::getRememberLoginCookie"方法中，函数 "unserialize" 存在没有正确过滤的用户输入，这可使远程攻击者通过Cookie报文头内的特制序列化对象，利用此漏洞删除任意文件或执行任意PHP代码。 0 openpne openpne 3.8.9 openpne...

CVE-2013-2309

Cross-site scripting XSS vulnerability in the management screen in OpenPNE 3.4.x before 3.4.21.1, 3.6.x before 3.6.9.1, and 3.8.x before 3.8.5.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the "mobile version color scheme."...

Cross site scripting

Cross-site scripting XSS vulnerability in the management screen in OpenPNE 3.4.x before 3.4.21.1, 3.6.x before 3.6.9.1, and 3.8.x before 3.8.5.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the "mobile version color scheme."...

CVE-2013-2309

Cross-site scripting XSS vulnerability in the management screen in OpenPNE 3.4.x before 3.4.21.1, 3.6.x before 3.6.9.1, and 3.8.x before 3.8.5.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the "mobile version color scheme."...