[SECURITY] [DLA 3761-1] spip security update

Debian LTS Advisory DLA-3761-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin March 15, 2024 https://wiki.debian.org/LTS Package : spip Version : 3.2.4-1+deb10u13 CVE ID : CVE-2023-52322 Debian Bug : 1059331 Hatim Chabik discovered a cross-site scripting XSS...

Debian dla-3761 : spip - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3761 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3761-1 [email protected] https://www.debian.org/lts/security/...

DLA-3761-1 spip - security update

Bulletin has no description...

SPIP < 4.1.14, 4.2.x < 4.2.8 XSS Vulnerability

SPIP is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:spip:spip";...

DEBIAN-CVE-2024-23659

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

CVE-2024-23659

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

CVE-2024-23659

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

Design/Logic Flaw

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

UBUNTU-CVE-2024-23659

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

CVE-2024-23659

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

CVE-2024-23659

SPIP is vulnerable to XSS in versions prior to 4.1.14 and 4.2.x prior to 4.2.8 when the name of an uploaded file is processed, related to javascript/bigup.js and javascript/bigup.utils.js. A fix is available in SPIP 4.1.14 and 4.2.8 (per SPIP maintenance release notes); upgrade to the respective ...

SPIP Security Vulnerabilities

SPIP is a freeware program from SPIP for creating Internet sites. A security vulnerability exists in SPIP versions prior to 4.1.14, 4.2.x through 4.2.8. An attacker could exploit the vulnerability to perform a cross-site scripting attack via the name of an uploaded file...

CVE-2024-23659

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

CVE-2024-23659

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

CVE-2024-23659

SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. This is related to javascript/bigup.js and javascript/bigup.utils.js...

SPIP < 4.1.13, 4.2.x < 4.2.7 XSS Vulnerability

SPIP is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:spip:spip";...

CVE-2023-52322

ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from request is not restricted to safe characters such as alphanumerics...

CVE-2023-52322

ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from request is not restricted to safe characters such as alphanumerics...

DEBIAN-CVE-2023-52322

ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from request is not restricted to safe characters such as alphanumerics...

Design/Logic Flaw

ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from request is not restricted to safe characters such as alphanumerics...