CVE-2019-16394

SPIP (website engine) versions affected: 3.1.x prior to 3.1.11 and 3.2.x prior to 3.2.5. The issue is in the password reminder flow, where error messages differ depending on whether the provided e-mail exists, enabling potential user enumeration of subscribers. Root cause: non-homogeneous handlin...

CVE-2019-16394

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...

CVE-2019-16394

SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...

PT-2019-4105 · Spip +1 · Spip +1

Name of the Vulnerable Software and Affected Versions: SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description: The issue is related to the lack of protection of the web page structure in the SPIP content management system. This can be exploited by a remote attacker to compromi...

PT-2019-4106 · Spip +1 · Spip +1

Name of the Vulnerable Software and Affected Versions: SPIP versions prior to 3.1.11 SPIP versions 3.2 prior to 3.2.5 Description: The issue is related to improper authorization in the SPIP content management system. It allows a remote attacker to compromise data integrity. Specifically, the...

SPIP 3.1.x/3.2.x Authenticated RCE Vulnerability

SPIP allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Debian DSA-4429-1 : spip - security update

It was discovered that SPIP, a website engine for publishing, did not properly sanitize its user input. This would allow an authenticated user to perform arbitrary command execution. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

Debian: Security Advisory (DSA-4429-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SPIP Arbitrary Code Execution Vulnerability

SPIP is a Web-based content publishing system. The system is primarily used for online collaboration. A security vulnerability exists in SPIP version 3.1 prior to 3.1.10 and version 3.2 prior to 3.2.4, which is caused by the program incorrectly handling varmemotri. An attacker can exploit this...

DEBIAN-CVE-2019-11071

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled...

CVE-2019-11071

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled...

CVE-2019-11071

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled...

CVE-2019-11071

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled...

Code injection

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled...

UBUNTU-CVE-2019-11071

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled...

CVE-2019-11071

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled...

CVE-2019-11071

CVE-2019-11071 affects SPIP 3.1.x before 3.1.10 and 3.2.x before 3.2.4, where mishandling of var_memotri enables an authenticated visitor to execute arbitrary code on the host server. The vulnerability is an authenticated RCE with high impact (CVE-3.x reported as high/critical depending on vector...

CVE-2019-11071

SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because varmemotri is mishandled...

[SECURITY] [DSA 4429-1] spip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4429-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 10, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4429-1] spip security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4429-1 [email protected] https://www.debian.org/security/ Sebastien Delafond April 10, 2019 https://www.debian.org/security/faq -...