CVE-2016-7980: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted validerxml request. NOTE: this issue can be combin...

CVE-2016-7999: Server-Side Request Forgery (SSRF)

ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery SSRF attacks via a URL in the varurl parameter in a validerxml action...

PT-2017-9453

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.2 and earlier Description The issue allows remote attackers to conduct server-side request forgery SSRF attacks. This is achieved by providing a URL in the var url parameter within a valider xml action, targeting the...

PT-2017-9442

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.2 and earlier Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted valider xml...

CVE-2016-7981: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the varurl parameter in a validerxml action...

PT-2017-9443

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.2 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the var url parameter in a "valider xml" action. Recommendations For SPIP versions 3.1.2 and earlie...

PT-2017-9452

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.2 and earlier Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by uploading an HTML file with a crafted INCLUDE or INCLURE tag and then accessing it with a valider xm...

CVE-2016-7982: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the varurl parameter in a validerxml action...

PT-2017-9444

Name of the Vulnerable Software and Affected Versions SPIP versions 3.1.2 and earlier Description A directory traversal issue exists, allowing remote attackers to enumerate system files via the var url parameter in a "valider xml" action. Recommendations For SPIP versions 3.1.2 and earlier, updat...

Debian DLA-760-1 : spip security update

Multiple reflected cross-site scripting XSS vulnerabilities have been discovered in SPIP, a website publishing engine written in PHP. CVE-2016-9997 It was discovered that the 'id' parameter to the pucestatut action isn't sanitized properly. An attacker could inject arbitrary HTML code by tricking...

[SECURITY] [DLA 760-1] spip security update

Package : spip Version : 2.1.17-1+deb7u8 CVE ID : CVE-2016-9997 CVE-2016-9998 Debian Bug : 848641 Multiple reflected cross-site scripting XSS vulnerabilities have been discovered in SPIP, a website publishing engine written in PHP. CVE-2016-9997 It was discovered that the id parameter to the...

DLA-760-1 spip - security update

Bulletin has no description...

SPIP Cross-Footprint Vulnerability (CNVD-2016-13014)

SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A cross-scripting vulnerability exists in the /ecrire/exec/infoplugin.php file in SPIP version 3.1.x. A remote attacker can inject arbitrary script or HTML with the help of a specially craft...

SPIP cross-site scripting vulnerability (CNVD-2016-13015)

SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A cross-site scripting vulnerability exists in the /ecrire/exec/pucestatut.php file in SPIP 3.1.x. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML wit...

SPIP 3.1.x < 3.1.4 'plugin' and 'id' Parameters Multiple XSS Vulnerabilities

SPIP is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:spip:spip"; i...

DEBIAN-CVE-2016-9997

SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/pucestatut.php involving the $id parameter, as demonstrated by a /ecrire/?exec=pucestatut URL...

Cross site scripting

SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/pucestatut.php involving the $id parameter, as demonstrated by a /ecrire/?exec=pucestatut URL...

UBUNTU-CVE-2016-9997

SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/pucestatut.php involving the $id parameter, as demonstrated by a /ecrire/?exec=pucestatut URL...

Cross site scripting

SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/infoplugin.php involving the $plugin parameter, as demonstrated by a /ecrire/?exec=infoplugin URL...

CVE-2016-9998

SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/infoplugin.php involving the $plugin parameter, as demonstrated by a /ecrire/?exec=infoplugin URL...