1516 matches found
CVE-2019-16392
SPIP vulnerability CVE-2019-16392 affects SPIP prior to 3.1.11 and 3.2 prior to 3.2.5. The issue is a cross-site scripting (XSS) through error messages exposed by login.php, allowing a remote attacker to trigger script execution via crafted input. The impact is described in CVSS terms as medium s...
CVE-2019-16393
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...
CVE-2019-16393
CVE-2019-16393 affects SPIP web CMS: versions 3.1.x before 3.1.11 and 3.2.x before 3.2.5 mishandle redirect URLs in ecrire/inc/headers.php when encountering %0D, %0A, or %20 characters. Root cause is improper handling of redirect URLs, as described in multiple advisories. Practical impact details...
CVE-2019-16393
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...
CVE-2019-16394
SPIP (website engine) versions affected: 3.1.x prior to 3.1.11 and 3.2.x prior to 3.2.5. The issue is in the password reminder flow, where error messages differ depending on whether the provided e-mail exists, enabling potential user enumeration of subscribers. Root cause: non-homogeneous handlin...
CVE-2019-16394
SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...
CVE-2019-16394
SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...
CVE-2019-16394: Observable Discrepancy
SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...
PT-2019-4105 · Spip +1 · Spip +1
Name of the Vulnerable Software and Affected Versions: SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description: The issue is related to the lack of protection of the web page structure in the SPIP content management system. This can be exploited by a remote attacker to compromi...
PT-2019-4103
Name of the Vulnerable Software and Affected Versions SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description The issue is related to the disclosure of user information. It might allow a remote attacker to gain unauthorized access to information. The problem is associated with...
PT-2019-4106 · Spip +1 · Spip +1
Name of the Vulnerable Software and Affected Versions: SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description: The issue is related to improper authorization in the SPIP content management system. It allows a remote attacker to compromise data integrity. Specifically, the...
CVE-2019-16392: Improper Neutralization of Input During Web Page Generation
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages...
CVE-2019-16391: Undefined Security Weakness
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiseraction.php...
CVE-2019-16393: URL Redirection to Untrusted Site
SPIP before 3.1.11 and 3.2 before 3.2.5 mishandles redirect URLs in ecrire/inc/headers.php with a %0D, %0A, or %20 character...
SPIP 3.1.x/3.2.x Authenticated RCE Vulnerability
SPIP allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Debian DSA-4429-1 : spip - security update
It was discovered that SPIP, a website engine for publishing, did not properly sanitize its user input. This would allow an authenticated user to perform arbitrary command execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...
Debian: Security Advisory (DSA-4429-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SPIP Arbitrary Code Execution Vulnerability
SPIP is a Web-based content publishing system. The system is primarily used for online collaboration. A security vulnerability exists in SPIP version 3.1 prior to 3.1.10 and version 3.2 prior to 3.2.4, which is caused by the program incorrectly handling varmemotri. An attacker can exploit this...
