906 matches found
CVE-2017-9071
MODX Revolution prior to version 2.5.7 is affected by an XSS vulnerability triggered by injecting a payload into the HTTP Host header, as part of a vulnerability chain (often with Cache Poisoning). The affected product is MODX Revolution; the issue is exploitable over the network and requires use...
CVE-2017-9069
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess...
CVE-2017-9068
MODX Revolution prior to 2.5.7 contains a Reflected XSS vulnerability. An attacker can trigger XSS by injecting payloads into several fields on the setup page, demonstrated via the database_type parameter. Affected product: MODX Revolution. Root cause: input supplied on the setup page is reflecte...
CVE-2017-9067
MODX Revolution before 2.5.7 is affected when using PHP 5.3.3. Insufficient validation of the action parameter to setup/index.php enables a directory traversal that allows an attacker to include and execute arbitrary files on the web server. The issue is documented across multiple sources as a vu...
CVE-2017-9070
CVE-2017-9070 affects MODX Revolution before 2.5.7. A user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php, enabling arbitrary script/HTML in titles. Root cause: input in the title field is not properly saniti...
CVE-2017-9070
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...
CVE-2017-9071
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning...
CVE-2017-9067
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...
CVE-2017-9068
In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...
CVE-2017-9069
MODX Revolution (PHP CMS) vulnerable before version 2.5.7. A user with file upload permissions can execute arbitrary code by uploading a file named ".htaccess". Root cause: improper handling of uploaded filenames allows code execution. Impact: arbitrary code execution with high impact and potenti...
CVE-2017-9067: Improper Limitation of a Pathname to a Restricted Directory
In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...
CVE-2017-9068: Improper Neutralization of Input During Web Page Generation
In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...
CVE-2017-9071: Improper Neutralization of Input During Web Page Generation
In MODX Revolution before 2.5.7, an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning...
CVE-2017-9069: Unrestricted Upload of File with Dangerous Type
In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess...
CVE-2017-9070: Improper Neutralization of Input During Web Page Generation
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...
MODX CMS 2.x < 2.5.7 Multiple Vulnerabilities
MODX CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:modx:revolution"; if description...
MODX Revolution SQL Injection Vulnerability
MODx is an open source PHP application framework that helps users control their online content. A SQL injection vulnerability exists in MODX Revolution versions 2.0.1-pl through 2.5.6-pl. An attacker can exploit the vulnerability to inject or manipulate SQL queries in the back-end database,...
Industrial Robots are Hackable: How Do We Fix Them?
Discuss cyber attacks involving robots and many people might think you’re talking about the latest Hollywood blockbuster to hit the screens. The reality, however, is that industrial robotic systems now form a vital cog in the manufacturing process of everything from silicon chips to cars and even...
MODX Revolution Directory Traversal Vulnerability (CNVD-2017-06899)
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in MODX Revolution version 2.5.7. The vulnerability arises du...
