UBUNTU-CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

CVE-2021-44123

SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it...

CVE-2021-44123

CVE-2021-44123 affects SPIP 4.0.0 and enables remote code execution via a crafted image with a double extension. An attacker must upload such a file and then convince a user to click it to trigger code execution. The vulnerability is addressed in Ubuntu 20.04 LTS via USN-5482-2, which notes patch...

CVE-2021-44123

SPIP 4.0.0 is affected by a remote command execution vulnerability. To exploit the vulnerability, an attacker must craft a malicious picture with a double extension, upload it and then click on it to execute it...

CVE-2021-44122

CVE-2021-44122 affects SPIP 4.0.0 with a CSRF in ecrire/public/aiguiller.php, ecrire/public/balises.php, and ecrire/balise/formulaire_.php. An attacker could lure a user to a malicious site to trigger CSRF, potentially combined with existing XSS vectors, and an authenticated attacker could execut...

CVE-2021-44122

SPIP 4.0.0 is affected by a Cross Site Request Forgery CSRF vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to...

CVE-2021-44122

SPIP 4.0.0 is affected by a Cross Site Request Forgery CSRF vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to...

CVE-2021-44120

CVE-2021-44120 affects SPIP 4.0.0 with a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php by adding the function safehtml to vulnerable fields. An editor can modify personal information, and if an article exists, a visitor reading the author’s information on the public sit...

CVE-2021-44120

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site...

CVE-2021-44120

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site...

CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

CVE-2021-44118

CVE-2021-44118 affects SPIP 4.0.0. A cross-site scripting (XSS) vulnerability allows an authenticated attacker to inject client-side code into pages visited by other users, via a malicious SVG file (stored XSS). The impact is described as execution of injected code on the client side for users vi...

CVE-2021-44118

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability. To exploit the vulnerability, a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users stored XSS...

SPIP 跨站脚本漏洞

SPIP is a web-based content publishing system. A cross-site scripting vulnerability exists in SPIP, which stems from a lack of proper validation of client-side data in the interfaces.php component of the WEB application. An attacker could exploit this vulnerability to execute client-side code...

SPIP 代码问题漏洞

SPIP is a Web-based content publishing system. The system is primarily used for online collaboration. A security vulnerability exists in SPIP, which can be exploited by an attacker to perform malicious actions by creating a malicious image with a double extension, uploading it, and then executing...

SPIP 跨站请求伪造漏洞

SPIP is a Web-based content publishing system. A cross-site request forgery vulnerability exists in SPIP, which stems from a Web application that does not adequately validate that requests are coming from trusted users. An attacker could use this vulnerability to send unintended requests to the...

Debian: Security Advisory (DLA-2867-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2867-1] spip security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2867-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler December 29, 2021 https://wiki.debian.org/LTS -...

DLA-2867-1 spip - security update

Bulletin has no description...

Debian DSA-5028-1 : spip - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5028 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 70300 C Tenable Network...