SPIP 跨站脚本漏洞

SPIP is a web-based content publishing system. A cross-site scripting vulnerability exists in SPIP, which stems from a lack of proper validation of client-side data in the interfaces.php component of the WEB application. An attacker could exploit this vulnerability to execute client-side code...

CVE-2021-44120: Improper Neutralization of Input During Web Page Generation

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site...

CVE-2021-44118: Improper Neutralization of Input During Web Page Generation

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

Debian: Security Advisory (DLA-2867-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2867-1] spip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2867-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler December 29, 2021 https://wiki.debian.org/LTS -...

DLA-2867-1 spip - security update

Bulletin has no description...

Debian DSA-5028-1 : spip - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5028 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable Network...

Debian: Security Advisory (DSA-5028-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5028-1] spip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5028-1 [email protected] https://www.debian.org/security/ Sebastien Delafond December 22, 2021 https://www.debian.org/security/faq -...

PT-2022-11997 · Spip +2 · Spip +2

Name of the Vulnerable Software and Affected Versions: SPIP version 4.0.0 Description: The issue is related to a Cross Site Request Forgery CSRF vulnerability in files such as ecrire/public/aiguiller.php, ecrire/public/balises.php, and ecrire/balise/formulaire .php. To exploit this, a visitor mus...

PT-2022-11995 · Spip +2 · Spip +2

Name of the Vulnerable Software and Affected Versions: SPIP version 4.0.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability in the ecrire/public/interfaces.php file, specifically affecting the "Who are you" and "Website Name" fields. An editor can modify their personal...

PT-2022-11998 · Spip +2 · Spip +2

Name of the Vulnerable Software and Affected Versions: SPIP version 4.0.0 Description: The issue is a remote command execution vulnerability. To exploit it, an attacker must craft a malicious picture with a double extension, upload it, and then click on it to execute it. Recommendations: For SPIP...

PT-2022-11994 · Spip +2 · Spip +2

Name of the Vulnerable Software and Affected Versions: SPIP version 4.0.0 Description: The issue allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users. This is achieved by exploiting a Cross Site Scripting XSS vulnerability, whe...

DSA-5028-1 spip - security update

Bulletin has no description...

The vulnerability of the prive/formulaires/configurer_preferences.php component of the SPIP content management system, related to a lack of mechanism for managing code generation, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the prive/formulaires/configurerpreferences.php component of the SPIP content management system is related to a lack of mechanisms for managing code generation. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity...

Debian: Security Advisory (DLA-2579-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2579-1 : spip security update

It was discovered that SPIP, a website engine for publishing, would allow a malicious user to perform cross-site scripting attacks, access sensitive information, or execute arbitrary code. For Debian 9 stretch, this problem has been fixed in version 3.1.4-4deb9u4+deb9u1. We recommend that you...

[SECURITY] [DLA 2579-1] spip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2579-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA March 02, 2021 https://wiki.debian.org/LTS -...

DLA-2579-1 spip - security update

Bulletin has no description...

Debian DSA-4853-1 : spip - security update

It was discovered that SPIP, a website engine for publishing, would allow a malicious user to perform cross-site scripting attacks, access sensitive information, or execute arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...