156 matches found
CVE-2015-5458
PivotX (fileupload.php) is affected by CVE-2015-5458: a session fixation vulnerability in PivotX before 2.3.11 allows remote attackers to hijack sessions via the sess parameter. Affected software: PivotX prior to 2.3.11; remediation is to upgrade to PivotX 2.3.11 or later (per CVE references).
CVE-2015-5458
Session fixation vulnerability in fileupload.php in PivotX before 2.3.11 allows remote attackers to hijack web sessions via the sess parameter...
CVE-2015-5456
PivotX is affected by CVE-2015-5456: an XSS in the form method (modules/formclass.php) present in PivotX versions before 2.3.11. The vulnerability is triggered via PATH_INFO (related to PHP_SELF) and form actions, allowing remote injection of script/html with no authentication. NVD notes CVSSv2 b...
CVE-2015-5457
PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers to execute arbitrary code by uploading a crafted file, as demonstrated by a file named foo.php.php...
CVE-2015-5456
Cross-site scripting XSS vulnerability in the form method in modules/formclass.php in PivotX before 2.3.11 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO, related to the "PHPSELF" variable and form actions...
Session Fixation, Reflected XSS, Code Execution in PivotX 2.3.10
Vulnerability: Session Fixation, Reflected XSS, Code Execution Affected Software: PivotX http://pivotx.net/ Affected Version: 2.3.10 probably also prior versions Patched Version: 2.3.11 Risk: Medium-High Session Fixation ================ Risk ---- Medium; If victim clicks link and logs in, then a...
PivotX 2.3.10 Session Fixation / XSS / Code Execution
Vulnerability: Session Fixation, Reflected XSS, Code Execution Affected Software: PivotX http://pivotx.net/ Affected Version: 2.3.10 probably also prior versions Patched Version: 2.3.11 Risk: Medium-High Session Fixation ================ Risk ---- Medium; If victim clicks link and logs in, then a...
PivotX多个跨站脚本漏洞
Bugtraq ID:66800 CVE ID:CVE-2014-0341 PivotX是一款功能强大的开源博客CMS系统。 PivotX overview screens存在跨站脚本漏洞，允许远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 PivotX 2.3.8 PivotX 2.3.9版本已修复该漏洞，建议用户下载使用： http://pivotx.net/...
PivotX 'fileupload.php'任意文件上传漏洞
Bugtraq ID:66797 CVE ID:CVE-2014-0342 PivotX是一款功能强大的开源博客CMS系统。 PivotX上传检查不正确处理文件名扩展，允许攻击者利用漏洞提交包含危险扩展类型的文件，并以WEB权限执行。 0 PivotX 2.3.8 PivotX 2.3.9版本已修复该漏洞，建议用户下载使用： http://pivotx.net/...
CVE-2014-0341
Multiple cross-site scripting XSS vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to 1 templatesinternal/pages.tpl, 2 templatesinternal/home.tpl, or 3 templatesinternal/entries.tpl; 4 an event field to objects.php;...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to 1 templatesinternal/pages.tpl, 2 templatesinternal/home.tpl, or 3 templatesinternal/entries.tpl; 4 an event field to objects.php;...
CVE-2014-0342
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .php or 2 .php extension, and then accessing it via unspecified vectors...
CVE-2014-0341
Multiple cross-site scripting XSS vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to 1 templatesinternal/pages.tpl, 2 templatesinternal/home.tpl, or 3 templatesinternal/entries.tpl; 4 an event field to objects.php;...
CVE-2014-0342
PivotX is affected by CVE-2014-0342 due to unrestricted file upload in fileupload.php. The issue occurs in PivotX before 2.3.9, where a file with a .php or .php# extension can be uploaded and then accessed via unspecified vectors, enabling remote execution of PHP code by an authenticated user. Th...
CVE-2014-0341
PivotX prior to 2.3.9 contains multiple XSS vulnerabilities (CVE-2014-0341) that allow remote authenticated users to inject arbitrary script/HTML via fields including title, event, email, nickname, and related template paths (templates_internal/pages.tpl, home.tpl, entries.tpl, objects.php, pages...
pivotx -- cross-site scripting (XSS) vulnerability
pivotx reports: cross-site scripting XSS vulnerability in the nickname and possibly the email field. Mitigated by the fact that an attacker must have a PivotX account...
pivotx -- Multiple unrestricted file upload vulnerabilities
Pivotx reports: Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .php or 2 .php extension, and then accessing it via unspecified vectors...
PivotX 2.3.8 contains multiple vulnerabilities
Overview PivotX 2.3.8, and possibly earlier versions, contains cross-site scripting CWE-79 and unsafe file upload CWE-434 vulnerabilities. Description PivotX 2.3.8, and possibly earlier versions, contains cross-site scripting CWE-79 and unsafe file upload CWE-434 vulnerabilities.CWE-79: Improper...
Cross site scripting
Cross-site scripting XSS vulnerability in pivotx/ajaxhelper.php in PivotX 2.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter...