1246 matches found
CVE-2016-3153
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrerentites function...
CVE-2016-3153
CVE-2016-3153 affects SPIP: 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1. The issue is a remote code execution vulnerability via content addition related to the filtrer_entites function, allowing an attacker to execute arbitrary PHP code. The provided connected documents consist...
CVE-2016-3154
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
CVE-2016-3153
SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to execute arbitrary PHP code by adding content, related to the filtrerentites function...
CVE-2016-3154
The encodercontexteajax function in ecrire/inc/filtres.php in SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object...
SPIP code injection vulnerability (CNVD-2016-01731)
SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A code injection vulnerability exists in SPIP. An attacker can exploit this vulnerability to inject arbitrary PHP code by performing an add content operation...
Debian DSA-3518-1 : spip - security update
Several vulnerabilities were found in SPIP, a website engine for publishing, resulting in code injection. - CVE-2016-3153 g0uZ et sambecks, from team root-me, discovered that arbitrary PHP code could be injected when adding content. - CVE-2016-3154 Gilles Vincent discovered that deserializing...
[SECURITY] [DSA 3518-1] spip security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3518-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 16, 2016 https://www.debian.org/security/faq -...
[SECURITY] [DSA 3518-1] spip security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3518-1 [email protected] https://www.debian.org/security/ Sebastien Delafond March 16, 2016 https://www.debian.org/security/faq -...
DSA-3518-1 spip - security update
Bulletin has no description...
Debian Security Advisory DSA 3518-1 (spip - security update)
Several vulnerabilities were found in SPIP, a website engine for publishing, resulting in code injection. CVE-2016-3153 g0uZ et sambecks, from team root-me, discovered that arbitrary PHP code could be injected when adding content. CVE-2016-3154 Gilles Vincent discovered that deserializing untrust...
Debian: Security Advisory (DSA-3518-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SPIP 1.8/1.9 Index.PHP3 Cross-Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/16461/info SPIP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script co...
SPIP 1.8.3 Spip_login.PHP Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/17423/info SPIP is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remot...
SPIP 1.8.2 Spip_RSS.PHP Remote Command Execution Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/16556/info SPIP is prone to a remote command-execution vulnerability. This is due to a lack of proper sanitization of user-supplied input. An attacker can exploit this issue to execute arbitrary remote PHP commands on an...
SPIP - CMS < 3.0.9 / 2.1.22 / 2.0.23 - Privilege Escalation
No description provided by source. !/usr/bin/env python Exploit Title: SPIP - CMS 3.0.9 / 2.1.22 / 2.0.23 - Privilege escalation to administrator account from non authenticated user Date: 04/30/2014 Flaw finder : Unknown Exploit Author: Gregory DRAPERI Email: gregory |dot| draperi |at| gmail |dot...
SPIP <= 1.8.2g Remote Commands Execution Exploit
No description provided by source. ?php ---spip182gshellinjxpl.php 17.33 08/02/2006 SPIP = 1.8.2g remote commands execution coded by rgod site: http://retrogod.altervista.org - this works regardless of magicquotesgpc settings usage: launch from Apache, fill in requested fields, then go! Sun-Tzu:...
SPIP connect Parameter PHP Injection
No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...
SPIP 1.8/1.9 - Multiple SQL Injection Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/16458/info SPIP is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful exploitation cou...
SPIP < 2.0.9 Arbitrary Copy All Passwords to XML File Remote Exploit
No description provided by source. !/usr/bin/env python SPIP - Content Management System 2.0.9 exploit http://www.securityfocus.com/bid/36008 Author : KernelPanik import urllib, urllib2 import cookielib import sys def sendrequesturlOpener, url, postdata=None: request = urllib2.Requesturl url =...