1336 matches found
CVE-2013-4555
Cross-site request forgery CSRF vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors...
CVE-2013-4557
The Security Screen core/securite/ecransecurite.php before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter...
CVE-2013-4556
Cross-site scripting XSS vulnerability in the author page prive/formulaires/editerauteur.php in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the urlsite parameter...
CVE-2013-4555
SPIP’s CSRF flaw CVE-2013-4555 affects action/logout.php in SPIP versions before 2.1.24. An attacker can hijack a user’s session by sending a logout request via unspecified vectors, enabling partial confidentiality/integrity/availability impact as described in the CVE entry. Multiple connected fe...
CVE-2013-4557
The Security Screen core/securite/ecransecurite.php before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter...
CVE-2013-4557
CVE-2013-4557 affects SPIP’s Security Screen component (core /securite/ecran_securite.php) prior to version 1.1.8, used in SPIP 3.0.x before 3.0.12. It allows remote attackers to execute arbitrary PHP via the connect parameter, leading to remote code execution. The vulnerability is documented acr...
CVE-2013-4556
The vulnerability CVE-2013-4556 affects SPIP’s author page (prive/formulaires/editer_auteur.php). It allows unauthenticated remote attackers to inject arbitrary script/HTML via the url_site parameter in SPIP versions before 2.1.24 and 3.0.x before 3.0.12. The core issue is a cross-site scripting ...
CVE-2013-4556
Cross-site scripting XSS vulnerability in the author page prive/formulaires/editerauteur.php in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the urlsite parameter...
[SECURITY] [DSA 2794-1] spip security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2794-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 10, 2013 http://www.debian.org/security/faq -...
[SECURITY] [DSA 2794-1] spip security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2794-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso November 10, 2013 http://www.debian.org/security/faq -...
Debian Security Advisory DSA 2794-1 (spip - several vulnerabilities)
Several vulnerabilities have been found in SPIP, a website engine for publishing, resulting in cross-site request forgery on logout, cross-site scripting on author page, and PHP injection. OpenVAS Vulnerability Test $Id: deb2794.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from adviso...
DSA-2794-1 spip - several
Bulletin has no description...
Debian: Security Advisory (DSA-2794-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SPIP Connect Parameter PHP Injection
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'SPIP connect Parameter PHP Injection'...
SPIP 'connect' Parameter PHP Code Injection Vulnerability (Aug 2013) - Active Check
SPIP is prone to a remote PHP code injection vulnerability. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:spip:spip"; if...
SPIP - 'connect' PHP Injection (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'SPIP connect Parameter PHP Injection'...
SPIP Detection (HTTP)
HTTP based detection of SPIP. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.103776";...
SPIP connect Parameter PHP Injection Vulnerability
This Metasploit module exploits a PHP code injection in SPIP. The vulnerability exists in the connect parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branches 2.0, 2.1 and 3 are concerned. This module works only against branch 2.0 and has been...
SPIP connect Parameter PHP Injection
This module exploits a PHP code injection in SPIP. The vulnerability exists in the connect parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges. Branches 2.0, 2.1 and 3 are concerned. Vulnerable versions are 'SPIP connect Parameter PHP Injection',...
