1246 matches found
CVE-2016-7981
Summary: CVE-2016-7981 is an XSS vulnerability in SPIP 3.1.2 and earlier. The issue occurs in the valider_xml.php handler, where the var_url parameter in a valider_xml action can be exploited by remote attackers to inject arbitrary web script or HTML into victims’ browsers. This is confined to SP...
CVE-2016-7980
Cross-site request forgery CSRF vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that execute the XML validator on a local file via a crafted validerxml request. NOTE: this issue can be combin...
CVE-2016-7982
Directory traversal vulnerability in ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to enumerate the files on the system via the varurl parameter in a validerxml action...
CVE-2016-7999
ecrire/exec/validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to conduct server side request forgery SSRF attacks via a URL in the varurl parameter in a validerxml action...
CVE-2016-7981
Cross-site scripting XSS vulnerability in validerxml.php in SPIP 3.1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the varurl parameter in a validerxml action...
CVE-2016-7998
The SPIP template composer/compiler in SPIP 3.1.2 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading an HTML file with a crafted 1 INCLUDE or 2 INCLURE tag and then accessing it with a validerxml action...
CVE-2016-7998
CVE-2016-7998 affects SPIP 3.1.2 and earlier, where remote authenticated users can trigger arbitrary PHP code execution by uploading an HTML file containing a crafted INCLUDE/INCLURE tag and then accessing it via the valider_xml action. The issue is tied to the SPIP template composer/compiler com...
Debian DLA-760-1 : spip security update
Multiple reflected cross-site scripting XSS vulnerabilities have been discovered in SPIP, a website publishing engine written in PHP. CVE-2016-9997 It was discovered that the 'id' parameter to the pucestatut action isn't sanitized properly. An attacker could inject arbitrary HTML code by tricking...
[SECURITY] [DLA 760-1] spip security update
Package : spip Version : 2.1.17-1+deb7u8 CVE ID : CVE-2016-9997 CVE-2016-9998 Debian Bug : 848641 Multiple reflected cross-site scripting XSS vulnerabilities have been discovered in SPIP, a website publishing engine written in PHP. CVE-2016-9997 It was discovered that the id parameter to the...
DLA-760-1 spip - security update
Bulletin has no description...
SPIP Cross-Footprint Vulnerability (CNVD-2016-13014)
SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A cross-scripting vulnerability exists in the /ecrire/exec/infoplugin.php file in SPIP version 3.1.x. A remote attacker can inject arbitrary script or HTML with the help of a specially craft...
SPIP cross-site scripting vulnerability (CNVD-2016-13015)
SPIP is a free Web-based content publishing system. The system is primarily used for online collaboration. A cross-site scripting vulnerability exists in the /ecrire/exec/pucestatut.php file in SPIP 3.1.x. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML wit...
SPIP 3.1.x < 3.1.4 'plugin' and 'id' Parameters Multiple XSS Vulnerabilities
SPIP is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:spip:spip"; i...
CVE-2016-9998
SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/infoplugin.php involving the $plugin parameter, as demonstrated by a /ecrire/?exec=infoplugin URL...
Cross site scripting
SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/infoplugin.php involving the $plugin parameter, as demonstrated by a /ecrire/?exec=infoplugin URL...
CVE-2016-9998
SPIP 3.1.x suffer from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/infoplugin.php involving the $plugin parameter, as demonstrated by a /ecrire/?exec=infoplugin URL...
Cross site scripting
SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/pucestatut.php involving the $id parameter, as demonstrated by a /ecrire/?exec=pucestatut URL...
CVE-2016-9997
SPIP 3.1.x suffers from a Reflected Cross Site Scripting Vulnerability in /ecrire/exec/pucestatut.php involving the $id parameter, as demonstrated by a /ecrire/?exec=pucestatut URL...