Debian DSA-5093-1 : spip - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5093 advisory. It was discovered that SPIP, a website engine for publishing, would allow a malicious user to execute arbitrary code. For the oldstable distribution buster, this...

PT-2022-18098

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 3.2.14 SPIP versions 4.x prior to 4.0.5 Description The issue allows unauthenticated access to information about editorial objects. Recommendations For SPIP versions prior to 3.2.14, update to version 3.2.14 or later. Fo...

PT-2022-18097

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 3.2.14 SPIP versions 4.x prior to 4.0.5 Description The issue allows remote authenticated editors to execute arbitrary code. Recommendations For SPIP versions prior to 3.2.14, update to version 3.2.14 or later. For SPIP...

DSA-5093-1 spip - security update

Bulletin has no description...

Cross-site Scripting (XSS)

spip is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the malicious SVG file...

Cross Site Scripting (XSS)

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site...

Cross-site Request Forgery (CSRF)

SPIP is vulnerable to cross site request forgery. The vulnerability exists due to a lack of sanitization of the origin of the source of request...

Remote Code Execution (RCE)

spip/spis is vulnerable to remote code execution. The vulnerability that exists in the file upload feature allows attacker to upload and execute malicious pictures with double extension...

SPIP Cross-site Request Forgery Vulnerability (CNVD-2022-08190)

SPIP is a Web-based content publishing system. A cross-site request forgery vulnerability exists in SPIP, which stems from a Web application that does not adequately validate that requests are coming from trusted users. An attacker could use this vulnerability to send unintended requests to the...

SPIP SVG Cross-Site Scripting Vulnerability

SPIP is a Web-based content publishing system. A cross-site scripting vulnerability exists in SPIP, which stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the vulnerability to execute client-side code...

SPIP interfaces.php cross-site scripting vulnerability

SPIP is a web-based content publishing system. A cross-site scripting vulnerability exists in SPIP, which stems from a lack of proper validation of client-side data in the interfaces.php component of the WEB application. An attacker could exploit this vulnerability to execute client-side code...

SPIP < 3.2.12, 4.x < 4.0.1 Multiple Vulnerabilities

SPIP is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...

CVE-2021-44123

SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it...

CVE-2021-44122

SPIP 4.0.0 is affected by a Cross Site Request Forgery CSRF vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to...

CVE-2021-44122

SPIP 4.0.0 is affected by a Cross Site Request Forgery CSRF vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to...

CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

DEBIAN-CVE-2021-44120

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site...

DEBIAN-CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

CVE-2021-44122

SPIP 4.0.0 is affected by a Cross Site Request Forgery CSRF vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to...

CVE-2021-44123

SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it...