156 matches found
CVE-2015-5458
PivotX (fileupload.php) is affected by CVE-2015-5458: a session fixation vulnerability in PivotX before 2.3.11 allows remote attackers to hijack sessions via the sess parameter. Affected software: PivotX prior to 2.3.11; remediation is to upgrade to PivotX 2.3.11 or later (per CVE references).
CVE-2015-5458
Session fixation vulnerability in fileupload.php in PivotX before 2.3.11 allows remote attackers to hijack web sessions via the sess parameter...
CVE-2015-5457
PivotX before 2.3.11 does not validate the new file extension when renaming a file with multiple extensions, which allows remote attackers to execute arbitrary code by uploading a crafted file, as demonstrated by a file named foo.php.php...
CVE-2015-5456
Cross-site scripting XSS vulnerability in the form method in modules/formclass.php in PivotX before 2.3.11 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO, related to the "PHPSELF" variable and form actions...
CVE-2015-5456
PivotX is affected by CVE-2015-5456: an XSS in the form method (modules/formclass.php) present in PivotX versions before 2.3.11. The vulnerability is triggered via PATH_INFO (related to PHP_SELF) and form actions, allowing remote injection of script/html with no authentication. NVD notes CVSSv2 b...
Session Fixation, Reflected XSS, Code Execution in PivotX 2.3.10
Vulnerability: Session Fixation, Reflected XSS, Code Execution Affected Software: PivotX http://pivotx.net/ Affected Version: 2.3.10 probably also prior versions Patched Version: 2.3.11 Risk: Medium-High Session Fixation ================ Risk ---- Medium; If victim clicks link and logs in, then a...
PivotX 2.3.10 Session Fixation / XSS / Code Execution
Vulnerability: Session Fixation, Reflected XSS, Code Execution Affected Software: PivotX http://pivotx.net/ Affected Version: 2.3.10 probably also prior versions Patched Version: 2.3.11 Risk: Medium-High Session Fixation ================ Risk ---- Medium; If victim clicks link and logs in, then a...
PivotX多个跨站脚本漏洞
Bugtraq ID:66800 CVE ID:CVE-2014-0341 PivotX是一款功能强大的开源博客CMS系统。 PivotX overview screens存在跨站脚本漏洞，允许远程攻击者可以利用漏洞构建恶意URI，诱使用户解析，可获得敏感Cookie，劫持会话或在客户端上进行恶意操作。 0 PivotX 2.3.8 PivotX 2.3.9版本已修复该漏洞，建议用户下载使用： http://pivotx.net/...
PivotX 'fileupload.php'任意文件上传漏洞
Bugtraq ID:66797 CVE ID:CVE-2014-0342 PivotX是一款功能强大的开源博客CMS系统。 PivotX上传检查不正确处理文件名扩展，允许攻击者利用漏洞提交包含危险扩展类型的文件，并以WEB权限执行。 0 PivotX 2.3.8 PivotX 2.3.9版本已修复该漏洞，建议用户下载使用： http://pivotx.net/...
CVE-2014-0341
Multiple cross-site scripting XSS vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to 1 templatesinternal/pages.tpl, 2 templatesinternal/home.tpl, or 3 templatesinternal/entries.tpl; 4 an event field to objects.php;...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to 1 templatesinternal/pages.tpl, 2 templatesinternal/home.tpl, or 3 templatesinternal/entries.tpl; 4 an event field to objects.php;...
CVE-2014-0342
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .php or 2 .php extension, and then accessing it via unspecified vectors...
CVE-2014-0341
Multiple cross-site scripting XSS vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to 1 templatesinternal/pages.tpl, 2 templatesinternal/home.tpl, or 3 templatesinternal/entries.tpl; 4 an event field to objects.php;...
CVE-2014-0341
PivotX prior to 2.3.9 contains multiple XSS vulnerabilities (CVE-2014-0341) that allow remote authenticated users to inject arbitrary script/HTML via fields including title, event, email, nickname, and related template paths (templates_internal/pages.tpl, home.tpl, entries.tpl, objects.php, pages...
CVE-2014-0342
PivotX is affected by CVE-2014-0342 due to unrestricted file upload in fileupload.php. The issue occurs in PivotX before 2.3.9, where a file with a .php or .php# extension can be uploaded and then accessed via unspecified vectors, enabling remote execution of PHP code by an authenticated user. Th...
pivotx -- Multiple unrestricted file upload vulnerabilities
Pivotx reports: Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a 1 .php or 2 .php extension, and then accessing it via unspecified vectors...
pivotx -- cross-site scripting (XSS) vulnerability
pivotx reports: cross-site scripting XSS vulnerability in the nickname and possibly the email field. Mitigated by the fact that an attacker must have a PivotX account...
PivotX 2.3.8 contains multiple vulnerabilities
Overview PivotX 2.3.8, and possibly earlier versions, contains cross-site scripting CWE-79 and unsafe file upload CWE-434 vulnerabilities. Description PivotX 2.3.8, and possibly earlier versions, contains cross-site scripting CWE-79 and unsafe file upload CWE-434 vulnerabilities.CWE-79: Improper...
Cross site scripting
Cross-site scripting XSS vulnerability in pivotx/ajaxhelper.php in PivotX 2.3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter...