127 matches found
CVE-2009-1462
The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact...
Code injection
Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file...
Cross site scripting
Cross-site scripting XSS vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the slab parameter in an edit action, 2 the catname parameter in a showcats action, and 3 the cat parameter in a reordercat action...
Design/Logic Flaw
The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact...
CVE-2009-1463
Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file...
CVE-2009-1459
Cross-site request forgery CSRF vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code...
CVE-2009-1463
The CVE-2009-1463 entry affects razorCMS prior to version 0.4. The issue is a static code injection flaw that lets remote attackers save content as a .php file, enabling arbitrary PHP execution on affected pages. The underlying cause is improper handling of content/file saves that allows code to ...
CVE-2009-1459
The CVE-2009-1459 issue targets razorCMS with a Cross‑Site Request Forgery vulnerability in versions before 0.4. The flaw allows an attacker to hijack an administrator’s session and perform actions that create a web page containing PHP code, potentially impacting authentication and content integr...
CVE-2009-1462
The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact...
CVE-2009-1461
CVE-2009-1461 describes a cross-site scripting (XSS) vulnerability in the Create New Page form of razorCMS 0.3 RC2 and earlier. The issue allows remote authenticated users to inject arbitrary script or HTML via the Page Title field. Affected component is the Create New Page workflow; vulnerabilit...
CVE-2009-1458
CVE-2009-1458 affects razorCMS prior to 0.4. The admin/index.php file contains multiple XSS flaws that allow remote attackers to inject arbitrary web script or HTML via (1) slab in the edit action, (2) catname in showcats, and (3) cat in reordercat. Impact is web-script/HTML injection without use...
CVE-2009-1460
razorCMS before 0.4 uses weak permissions for 1 admin/core/adminconfig.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and 2 the root directory, 3 datastore/, and 4 admin/core/, which allows local users to have an unspecified impact...
CVE-2009-1458
Multiple cross-site scripting XSS vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the slab parameter in an edit action, 2 the catname parameter in a showcats action, and 3 the cat parameter in a reordercat action...
CVE-2009-1460
CVE-2009-1460 affects razorCMS before 0.4. The issue is weak file system permissions: admin/core/admin_config.php exposes the administrator password hash and FTP credentials to local users; the root directory, datastore/, and admin/core/ also have insufficient permissions, allowing local users to...
CVE-2009-1462
The CVE-2009-1462 entry concerns razorCMS prior to version 0.4, where the Security Manager does not verify the permissions of every file owned by the Apache user, conflicting with documentation. This could enable local users to cause an unspecified impact. The provided documents do not detail the...
CVE-2009-1461
Cross-site scripting XSS vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field...
CVE-2009-1462: Undefined Security Weakness
The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact...
CVE-2009-1463: Improper Control of Generation of Code
Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file...