523 matches found
YzmCMS User Traversal Vulnerability
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A security vulnerability exists in the password retrieval function of the index.php/member/reset/resetemail.html page in YzmCMS version 3.2 to 3.7, which originates from the validity period of the...
CVE-2018-11554
The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...
CVE-2018-11554
The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...
CVE-2018-11554
The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...
CVE-2018-11554
Affected software: YzmCMS v3.2–v3.7 (index.php/member/reset/reset_email.html). Root cause / issue type: response discrepancy information exposure and an unexpectedly long lifetime for the verification code in the forgotten-password flow. Impact (as stated): easier for remote attackers to hijack a...
PT-2018-10662
Name of the Vulnerable Software and Affected Versions YzmCMS versions 3.2 through 3.7 Description The issue concerns the forgotten-password feature in the index.php/member/reset/reset email.html file, which has a Response Discrepancy Information Exposure problem. Additionally, the verification co...
CVE-2018-11554: Exposure of Sensitive Information to an Unauthorized Actor
The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...
Stored Cross-Site Scripting Vulnerability in YzmCMS v3.8
YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. A stored cross-site scripting vulnerability exists in YzmCMS v3.8. Attackers can insert malicious js code in the page to obtain user...
CVE-2018-10224
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...
CVE-2018-10223
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...
Cross site request forgery (csrf)
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...
Cross site request forgery (csrf)
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...
CVE-2018-10223
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...
CVE-2018-10224
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...
CVE-2018-10223
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...
CVE-2018-10223
CVE-2018-10223 affects YzmCMS 3.8. It is a Cross-Site Request Forgery (CSRF) vulnerability in /index.php/admin/admin_manage/add.html that can add an administrator account. Implication: attacker could obtain admin privileges on the affected system. Root cause: CSRF flaw enabling unauthorized admin...
CVE-2018-10224
CVE-2018-10224 describes a CSRF vulnerability in YzmCMS 3.8 that allows adding a tag via /index.php/admin/tag/add.html. The connected documents consistently reference this vulnerability in YzmCMS 3.8 and identify the attack surface as the admin tag-add endpoint. The CVE details do not provide exp...
CVE-2018-10224
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...
YzmCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-08781)
YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site request forgery vulnerability exists in YzmCMS version 3.8. A remote attacker can add an administrator account with the help of the /index.php/admin/adminmanage/add.html page to explo...